CVE-2026-70007
HighCVSS 8.8Summary
An out-of-bounds write exists in .NET Framework. An unauthorized attacker can exploit this vulnerability to execute code over a network.
Risk Assessment
This vulnerability allows remote code execution without authentication, potentially leading to full system compromise. The risk is high for systems exposed to network traffic.
Recommendation
Promptly install the latest .NET Framework updates from Microsoft. It is also recommended to limit network exposure of applications using .NET Framework.
Other vulnerabilities in .NET Framework
See all- CVE-2026-97801High
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
- CVE-2026-85363High
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70035High
A deserialization of untrusted data vulnerability exists in .NET Framework. An unauthorized attacker can exploit this flaw to execute code over a network.
- CVE-2026-108398High
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
- CVE-2017-8585High
Microsoft .NET Framework versions 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service.
- CVE-2017-0160High
Microsoft .NET Framework versions 2.0, 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, and 4.7 allows an attacker with access to the local system to execute malicious code, known as '.NET Remote Code Execution Vulnerability.'
- CVE-2016-7270High
The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, allowing remote attackers to bypass the Always Encrypted protection mechanism and obtain sensitive cleartext information.
- CVE-2016-0033High
Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, allowing remote attackers to cause a denial of service via crafted XSLT data.
- CVE-2014-4121High
Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 improperly parse internationalized resource identifiers, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted request to a .NET web application.
- CVE-2014-4073High
A vulnerability in Microsoft .NET Framework allows remote attackers to gain privileges through unverified data during interaction with the ClickOnce installer. It affects versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2.
Original NVD description (English source)
Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS