DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-70035: CVE-2026-70035: Insecure Deserialization Remote Code Execution in Microsoft .NET Framework and .NET Runtime

#security #cve #cybersecurity

CVE-2026-70035: Insecure Deserialization Remote Code Execution in Microsoft .NET Framework and .NET Runtime

Vulnerability ID: CVE-2026-70035
CVSS Score: 8.8
Published: 2026-10-13

CVE-2026-70035 is a high-severity Remote Code Execution (RCE) vulnerability in Microsoft .NET Framework, .NET runtime, and Visual Studio caused by improper handling during the deserialization of untrusted data (CWE-502). An unauthenticated attacker can execute arbitrary code within the context of the affected process by delivering a crafted serialized payload.

TL;DR

An insecure deserialization vulnerability in .NET allows unauthenticated attackers to execute arbitrary code via crafted object graphs requiring user interaction.

Technical Details

  • CWE ID: CWE-502 (Deserialization of Untrusted Data)
  • CVSSv3.1 Score: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
  • Attack Vector: Network
  • Privileges Required: None
  • User Interaction: Required
  • Exploit Status: Unproven / None
  • CISA KEV Status: Not Listed

Affected Systems

  • Microsoft .NET 8.0
  • Microsoft .NET 9.0
  • Microsoft .NET 10.0
  • Microsoft .NET 11.0
  • Microsoft .NET Framework 3.5
  • Microsoft .NET Framework 4.6.2
  • Microsoft .NET Framework 4.7
  • Microsoft .NET Framework 4.7.1
  • Microsoft .NET Framework 4.7.2
  • Microsoft .NET Framework 4.8
  • Microsoft .NET Framework 4.8.1
  • Microsoft Visual Studio 2022 version 17.14
  • Microsoft Visual Studio 2026 version 18.10
  • .NET: >= 8.0.0, < 8.0.32 (Fixed in: 8.0.32)
  • .NET: >= 9.0.0, < 9.0.21 (Fixed in: 9.0.21)
  • .NET: >= 10.0.0, < 10.0.13 (Fixed in: 10.0.13)
  • .NET Framework: < 4.8.9363.0 (Fixed in: 4.8.9363.0)
  • Visual Studio 2022: >= 17.14.0, < 17.14.42 (Fixed in: 17.14.42)

Mitigation Strategies

  • Apply official vendor security updates for .NET runtime, .NET Framework, and Visual Studio.
  • Replace legacy binary and polymorphic serializers with modern non-polymorphic formats such as System.Text.Json.
  • Implement strict custom SerializationBinder type whitelisting for applications that must deserialize binary data.

Remediation Steps:

  1. Identify all installed instances of .NET runtimes (8.0, 9.0, 10.0, 11.0) and .NET Framework.
  2. Upgrade .NET 8.0 installations to version 8.0.32 or higher.
  3. Upgrade .NET 9.0 installations to version 9.0.21 or higher.
  4. Upgrade .NET 10.0 installations to version 10.0.13 or higher.
  5. Apply October 2026 Microsoft Security Updates for .NET Framework via Windows Update.
  6. Upgrade Visual Studio 2022 to version 17.14.42 and Visual Studio 2026 to 18.10.4.

References

Read the full report for CVE-2026-70035 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)