Out-of-bounds write in Microsoft products - CVE-2026-96233

Vulnerability identifier: #VU155433

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-96233

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in ASP.NET Core when handling network input. A remote attacker can interact with the affected component over a network to cause a denial of service.

.NET
Microsoft .NET Framework
.NET for Linux
.NET for macOS

Install security update from vendor's website.

.NET - addressed in versions 8.0.32, 9.0.21
Microsoft .NET Framework - addressed in versions 2.0.50727.8987 AND 3.0.30729.8982, 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0, 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0, 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0, 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0, 4.7.4150.0, 4.8.4811.0, 10.0.13
.NET for Linux - addressed in versions 8.0.32, 9.0.21
.NET for macOS - addressed in versions 8.0.32, 9.0.21

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96233
• https://support.microsoft.com/help/5130036

• Multiple vulnerabilities in Microsoft Windows