high8.8

CVE-2026-70035

Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.

Impact

Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.

Ecosystem	Package	Affected	Fixed in
nuget	`Microsoft.WindowsDesktop.App.Runtime.win-arm64`	>= 10.0.0, <= 10.0.12	10.0.13
nuget	`Microsoft.WindowsDesktop.App.Runtime.win-x64`	>= 10.0.0, <= 10.0.12	10.0.13
nuget	`Microsoft.WindowsDesktop.App.Runtime.win-x86`	>= 10.0.0, <= 10.0.12	10.0.13

Vendor	Product	Affected versions
Microsoft	.NET 11.0 Runtime	from 11.0.0 before 11.0.0-rc.2
Microsoft	Microsoft Visual Studio 2026 Version 18.10	from 18.10.0 before 18.10.4
Microsoft	Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2	Version 3.0.0.0 <2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0
Microsoft	Microsoft .NET Framework 3.5	Version 3.5.0 <2.0.50727.9188 AND 3.0.30729.9171
Microsoft	Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2	from 4.7.0 before 4.7.4150.0
Microsoft	.NET 10.0 Runtime	from 10.0.0 before 10.0.13
Microsoft	.NET 9.0 Runtime	from 9.0.0 before 9.0.21
Microsoft	Microsoft .NET Framework 3.5 AND 4.8.1	Version 4.8.1 <2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0
Microsoft	Microsoft .NET Framework 4.8.1	from 4.8.0.0 before 4.8.9363.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.8	Version 4.8.0 <2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2	Version 4.7.0 <2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0
Microsoft	.NET 8.0 Runtime	from 8.0.0 before 8.0.32