.NET Runtime CVE-2026-70197

Exploitation is limited to Windows and requires the target .NET application to reuse a single SocketAsyncEventArgs instance across both an IPv4 and an IPv6 datagram (UDP) socket, which leaves an undersized cached native address buffer in place; the out-of-bounds write is then triggered through ReceiveFromAsync. No authentication or user interaction is required (PR:N/UI:N), but the AC:H rating and non-default coding pattern (cross-family SocketAsyncEventArgs reuse on UDP sockets) are the key limiting factors - applications that do not share SocketAsyncEventArgs across IPv4/IPv6 datagram sockets are not exposed, and non-Windows platforms are unaffected.

This is a high-severity (CVSS 8.1) memory-corruption RCE in .NET's System.Net.Sockets, but multiple signals indicate it is a meaningful-yet-non-urgent patching priority rather than an active emergency. The CVSS vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated flaw with full CIA impact, which is why the score is high; however, AC:H flags that successful exploitation is non-trivial. CISA's SSVC framework reinforces this nuance: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (cannot be reliably mass-exploited/scripted), yet Technical Impact is 'total' - so the ceiling is severe but the likelihood and scalability of attack are currently low. No KEV listing and no POC are present in the provided data, so there is no evidence of exploitation in the wild. There are no conflicting signals here; the data is internally consistent (high theoretical impact, low current exploitability). The practical catch is that the vulnerable condition is narrow (see exploitation_conditions), which further dampens real-world risk despite the 'unauthenticated network' framing.

A .NET server application on Windows reuses a single SocketAsyncEventArgs instance across both IPv4 and IPv6 UDP (datagram) sockets; an undersized cached native address buffer is retained, and a remote unauthenticated attacker sends crafted datagrams that are received via ReceiveFromAsync, triggering an out-of-bounds write that can corrupt memory and potentially lead to remote code execution. The AC:H rating reflects that the attacker depends on the application already exhibiting this specific IPv4/IPv6 SocketAsyncEventArgs reuse pattern. No public exploit code is identified at time of analysis, and SSVC marks the flaw as not automatable.