CVE-2026-96233

Awaiting Analysis Awaiting Analysis - Queue

Out-of-bounds Write in ASP.NET Core

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Microsoft Corporation

Description

Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96233

EUVD

EUVD-2026-100203

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	.NET	10.0 10.0.0
Microsoft	.NET	11.0 11.0.0
Microsoft	.NET	8.0 8.0.0
Microsoft	.NET	9.0 9.0.0
Microsoft	Microsoft	.NET Framework 3.5 3.5.0
Microsoft	Microsoft	.NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 3.0.0.0
Microsoft	Microsoft	.NET Framework 3.5 AND 4.7.2 4.7.0
Microsoft	Microsoft	.NET Framework 3.5 AND 4.8 4.8.0
Microsoft	Microsoft	.NET Framework 3.5 AND 4.8.1 4.8.1
Microsoft	Microsoft	.NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.0
Microsoft	Microsoft	.NET Framework 4.8 4.8.0
Microsoft	Microsoft	.NET Framework 4.8.1 4.8.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is an out-of-bounds write vulnerability in ASP.NET Core. It allows an unauthorized attacker to cause a denial of service over a network by exploiting memory corruption issues.

Impact Analysis

An attacker could exploit this to crash applications or services running on affected systems, leading to service unavailability. This may disrupt normal operations for users relying on ASP.NET Core applications.

Compliance Impact

This vulnerability enables denial-of-service attacks, which could disrupt services handling sensitive data. GDPR requires ensuring availability of personal data processing systems, while HIPAA mandates safeguards against service disruptions affecting protected health information. Exploitation could violate these requirements by compromising system availability.

Mitigation Strategies

Apply the latest security updates from Microsoft for ASP.NET Core and .NET Framework versions listed in the CVE. Monitor Microsoft's update guide for patches and install them promptly to prevent denial of service attacks.

Hi! I’m here to help you understand CVE-2026-96233. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70