high8.8

CVE-2026-70007

Microsoft Security Advisory CVE-2026-70007 - .NET and Visual Studio Remote Code Execution Vulnerability

Impact

Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.

Ecosystem	Package	Affected	Fixed in
nuget	`Microsoft.WindowsDesktop.App.Runtime.win-arm64`	>= 9.0.0, <= 9.0.20	9.0.21
nuget	`Microsoft.WindowsDesktop.App.Runtime.win-x64`	>= 9.0.0, <= 9.0.20	9.0.21
nuget	`Microsoft.WindowsDesktop.App.Runtime.win-x86`	>= 9.0.0, <= 9.0.20	9.0.21

Vendor	Product	Affected versions
Microsoft	Microsoft Visual Studio 2026 Version 18.10	from 18.10.0 before 18.10.4
Microsoft	Microsoft .NET Framework 3.5 AND 4.8.1	Version 4.8.1 <2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.8	Version 4.8.0 <2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0
Microsoft	.NET 8.0 Runtime	from 8.0.0 before 8.0.32
Microsoft	.NET 11.0 Runtime	from 11.0.0 before 11.0.0-rc.2
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2	Version 4.7.0 <2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0
Microsoft	Microsoft Visual Studio 2022 Version 17.14	from 17.14.0 before 17.14.42
Microsoft	Microsoft .NET Framework 4.8	from 4.8.0 before 4.8.4811.0
Microsoft	.NET 10.0 Runtime	from 10.0.0 before 10.0.13
Microsoft	Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2	Version 3.0.0.0 <2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0
Microsoft	Microsoft .NET Framework 4.8.1	from 4.8.0.0 before 4.8.9363.0
Microsoft	Microsoft .NET Framework 3.5	Version 3.5.0 <2.0.50727.8987 AND 3.0.30729.8982