Microsoft Patches CVE-2026-96232 in .NET Windows Desktop Runtimes to Stop Remote Info Disclosure
Microsoft releases updates for .NET Windows Desktop runtimes to address a high-severity vulnerability that allows remote attackers to disclose sensitive information.
Key points
- Microsoft patched CVE-2026-96232 in .NET Windows Desktop runtimes for Windows.
- The flaw is an out-of-bounds read rated high severity with a CVSS score of 7.5.
- Affected versions include releases 8, 9, 10 and early 11 previews across x86, x64 and ARM64.
An attacker exploiting this vulnerability can remotely access memory outside the intended bounds of the application, leading to information disclosure. According to Microsoft, this allows an unauthorized user to disclose information over a network without needing authentication or user interaction.
In plain English
This issue stems from how the .NET Windows Desktop runtime handles memory reads. The application attempts to read data from a location it should not access, potentially exposing internal state or sensitive data to an external observer. The flaw exists in the Windows Presentation Foundation component of the runtime.
The background
Microsoft released security updates addressing CVE-2026-96232 across multiple supported versions of the .NET runtime. The vulnerability affects packages Microsoft.WindowsDesktop.App.Runtime.win-arm64, win-x64 and win-x86. Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12 and 11.0.0-preview.1 through 11.0.0-rc.1 are vulnerable.
What changes now
Users must update to the patched versions to mitigate the risk. Patched versions include 8.0.32, 9.0.21, 10.0.13 and 11.0.0-rc.2. The CVSS 3.1 score is 7.5, classified as high severity. The attack vector is network-based, with low complexity and no privileges required.
What made it possible
Teams usually encounter out-of-bounds read flaws when software fails to validate memory boundaries before accessing data. This weakness typically serves the reconnaissance or exploitation phase of an intrusion, allowing attackers to leak memory contents. Check whether applications validate input lengths against buffer sizes. Ensure that memory access routines include strict bounds checking. Monitor for unusual memory read patterns that may indicate an attempt to extract sensitive information from adjacent memory regions.
What to do and how to stay safe: Microsoft
- Review your inventory of .NET Windows Desktop runtime versions to identify any installations matching the vulnerable ranges listed in the advisory.
- Plan and execute updates to the patched versions (8.0.32, 9.0.21, 10.0.13 or 11.0.0-rc.2) as soon as possible to close the exposure window.
- Monitor network traffic for anomalous data exfiltration patterns that could indicate an attacker is exploiting the information disclosure flaw.
- Verify that your deployment pipeline automatically pulls the latest secure package versions from NuGet to prevent re-introduction of vulnerable components.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific .NET versions are affected by CVE-2026-96232?
Versions 8.0.0 to 8.0.31, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12 and 11.0.0-preview.1 to 11.0.0-rc.1 are affected.
Is user interaction required to exploit this vulnerability?
No, the CVSS vector indicates no user interaction is required, and the attack can be performed remotely over a network.
What is the CVSS score for this flaw?
The CVSS 3.1 score is 7.5, which Microsoft classifies as high severity.
