CVE-2026-96233: CWE-787: Out-of-bounds Write in Microsoft .NET 10.0

This vulnerability (CWE-787) in Microsoft .NET 10.0's System.Runtime component allows out-of-bounds writes during Hebrew-number parsing of DateTime values. This can lead to process termination due to reading outside expected stack bounds. The issue affects multiple runtime packages across Windows, Linux, and macOS platforms and various architectures. The CVSS 3.1 score is 7.5 (High), indicating a network exploitable vulnerability with low attack complexity and no privileges or user interaction required, causing availability impact only. Microsoft has provided official patches for all affected versions.

The vulnerability causes process termination (availability impact) due to out-of-bounds writes in the DateTime Hebrew-number parsing logic. There is no confidentiality or integrity impact reported. Exploitation does not require privileges or user interaction and can be triggered remotely, potentially causing denial of service in applications using affected .NET runtime versions.

An official fix is available from Microsoft. Users and developers should update affected Microsoft .NET runtime packages to the patched versions (e.g., 10.0.13 for .NET 10.0 packages). Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96233 for detailed update instructions. Applying these updates will mitigate the vulnerability.