CVE-2026-70197: CWE-787: Out-of-bounds Write in Microsoft .NET 10.0

This vulnerability (CWE-787) affects the System.Net.Sockets component in Microsoft .NET on Windows platforms. Specifically, reusing a SocketAsyncEventArgs instance across IPv4 and IPv6 datagram sockets can cause the native address buffer to be undersized and cached improperly. This leads to an out-of-bounds write during the ReceiveFromAsync operation, which can compromise the confidentiality, integrity, and availability of affected systems. The issue affects multiple runtime package versions from 8.0.0 up to but not including 8.0.32, 9.0.0 up to 9.0.21, 10.0.0 up to 10.0.13, and 11.0.0-preview.1 up to 11.0.0-rc.2. Microsoft has provided official fixes in these versions and advises updating to the patched versions and recompiling any self-contained applications.

Successful exploitation allows an unauthenticated attacker to perform an out-of-bounds write, potentially leading to arbitrary code execution or system compromise. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector. It affects all Windows architectures running the vulnerable .NET runtime versions.

An official fix is available. Users should update to the patched versions of the affected Microsoft.NETCore.App.Runtime.win packages as listed in the advisory (e.g., 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2). Applications must be restarted after updating the runtime or SDK. For self-contained applications targeting affected versions, recompilation and redeployment with the patched runtime are required. Visual Studio users will be prompted to update the .NET SDKs accordingly.