Skip to content

Instantly share code, notes, and snippets.

@alon710

alon710/CVE-2026-70035.md

Created October 13, 2026 21:30
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save alon710/64ee4a71955f65a801790ed533374bdc to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save alon710/64ee4a71955f65a801790ed533374bdc to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2026-70035: CVE-2026-70035: Insecure Deserialization Remote Code Execution in Microsoft .NET Framework and .NET Runtime - CVE Security Report
Raw
CVE-2026-70035.md

CVE-2026-70035: CVE-2026-70035: Insecure Deserialization Remote Code Execution in Microsoft .NET Framework and .NET Runtime

CVSS Score: 8.8 Published: 2026-10-13 Full Report: https://cvereports.com/reports/CVE-2026-70035

Summary

CVE-2026-70035 is a high-severity Remote Code Execution (RCE) vulnerability in Microsoft .NET Framework, .NET runtime, and Visual Studio caused by improper handling during the deserialization of untrusted data (CWE-502). An unauthenticated attacker can execute arbitrary code within the context of the affected process by delivering a crafted serialized payload.

TL;DR

An insecure deserialization vulnerability in .NET allows unauthenticated attackers to execute arbitrary code via crafted object graphs requiring user interaction.

Technical Details

  • CWE ID: CWE-502 (Deserialization of Untrusted Data)
  • CVSSv3.1 Score: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
  • Attack Vector: Network
  • Privileges Required: None
  • User Interaction: Required
  • Exploit Status: Unproven / None
  • CISA KEV Status: Not Listed

Affected Systems

  • Microsoft .NET 8.0
  • Microsoft .NET 9.0
  • Microsoft .NET 10.0
  • Microsoft .NET 11.0
  • Microsoft .NET Framework 3.5
  • Microsoft .NET Framework 4.6.2
  • Microsoft .NET Framework 4.7
  • Microsoft .NET Framework 4.7.1
  • Microsoft .NET Framework 4.7.2
  • Microsoft .NET Framework 4.8
  • Microsoft .NET Framework 4.8.1
  • Microsoft Visual Studio 2022 version 17.14
  • Microsoft Visual Studio 2026 version 18.10
  • .NET: >= 8.0.0, < 8.0.32 (Fixed in: 8.0.32)
  • .NET: >= 9.0.0, < 9.0.21 (Fixed in: 9.0.21)
  • .NET: >= 10.0.0, < 10.0.13 (Fixed in: 10.0.13)
  • .NET Framework: < 4.8.9363.0 (Fixed in: 4.8.9363.0)
  • Visual Studio 2022: >= 17.14.0, < 17.14.42 (Fixed in: 17.14.42)

Mitigation

  • Apply official vendor security updates for .NET runtime, .NET Framework, and Visual Studio.
  • Replace legacy binary and polymorphic serializers with modern non-polymorphic formats such as System.Text.Json.
  • Implement strict custom SerializationBinder type whitelisting for applications that must deserialize binary data.

Remediation Steps:

  1. Identify all installed instances of .NET runtimes (8.0, 9.0, 10.0, 11.0) and .NET Framework.
  2. Upgrade .NET 8.0 installations to version 8.0.32 or higher.
  3. Upgrade .NET 9.0 installations to version 9.0.21 or higher.
  4. Upgrade .NET 10.0 installations to version 10.0.13 or higher.
  5. Apply October 2026 Microsoft Security Updates for .NET Framework via Windows Update.
  6. Upgrade Visual Studio 2022 to version 17.14.42 and Visual Studio 2026 to 18.10.4.

References

Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment