EUVD-2026-100206
GHSA-f8qh-mqg4-9939
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-facing .NET service
-
DeliverySend crafted malformed input
-
ExploitTrigger out-of-bounds read in parser
-
ExecutionReceive leaked adjacent memory
-
ImpactDisclose sensitive information
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a vulnerable .NET application or service (built on .NET 8.0<8.0.32, 9.0<9.0.21, 10.0<10.0.13, 11.0<11.0.0-rc.2, or developed in Visual Studio 2022<17.14.42 / 2026<18.10.4) be network-reachable and accept attacker-controlled input through the affected code path. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special configuration is required, and attacks are scriptable (SSVC Automatable:yes). Limiting factors: the flaw discloses information only (C:H, I:N/A:N) and does not grant code execution or modification; actual risk depends on the vulnerable API being invoked on untrusted input, which the advisory does not enumerate, so applications that never route untrusted data through the affected component are not exposed. |
| Impact | Signals are mixed, leaning toward moderate-but-real priority rather than emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with high confidentiality impact only (C:H/I:N/A:N), yielding 7.5 - a pure information-disclosure flaw with no integrity or availability effect. CISA's SSVC framework reports Exploitation: none (no observed or public exploitation), Automatable: yes (attacks could be scripted at scale), and Technical Impact: partial (consistent with read-only disclosure, not full compromise). No EPSS score was supplied, and there is no CISA KEV listing and no POC reference, so exploitation status is 'no public exploit identified at time of analysis.' The tension to flag: SSVC marks this Automatable:yes while Exploitation:none - i.e. it is theoretically mass-exploitable but not currently seen being used, suggesting the priority is driven by exposure/footprint rather than observed activity. Treat as a priority to patch due to .NET's enormous deployment footprint and unauthenticated network vector, but it is not a drop-everything KEV-grade threat on current evidence. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted input to a network-facing .NET application or service, triggering an out-of-bounds read (CWE-125) in a parsing/processing routine that returns adjacent memory contents to the attacker. This could leak sensitive in-process data such as fragments of other requests, tokens, or memory layout useful for further attacks. No public exploit code is identified at time of analysis, and the CVSS AC:L indicates no special timing or race conditions are needed once a vulnerable code path is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An out-of-bounds read in the .NET runtime and toolchain (CVE-2026-96232) allows an unauthenticated, remote attacker to read memory beyond intended buffer boundaries and disclose its contents over the network, rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Affected builds are .NET 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13 and 11.0 before 11.0.0-rc.2, plus applications developed with Microsoft Visual Studio 2022 before 17.14.42 and Visual Studio 2026 before 18.10.4. Only confidentiality is impacted - there is no code execution, privilege escalation or data modification - and no public exploit identified at time of analysis; CISA's SSVC assessment records exploitation as none while noting the attack is automatable, and intelligence sources indicate a vendor patch is available. The practical risk depends entirely on whether a vulnerable .NET application exposes the affected code path to untrusted network input, so internet-facing services built on the unpatched runtimes are the priority targets.
RemediationAI
Apply the vendor-released patch: upgrade .NET to 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2 (or later) depending on your release train, and update Visual Studio 2022 to 17.14.42 or later and Visual Studio 2026 to 18.10.4 or later; Microsoft's guidance is published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96232 with additional tracking at https://www.herodevs.com/vulnerability-directory/cve-2026-96232. Because .NET is frequently deployed as shared framework or container base images, patch the runtime image and rebuild or redeploy affected applications rather than assuming the host-level update covers self-contained deployments; verify the resolved runtime version at runtime rather than trusting the build manifest. Until patching completes, compensating controls should focus on reachability: restrict network access to .NET services that accept untrusted input via firewall rules, reverse-proxy ACLs, or private endpoints, accepting the trade-off that this breaks legitimate external clients; disable or gate any feature that parses attacker-supplied input through the affected component if the application owner can identify it from testing, understanding that this may degrade functionality; and increase logging/monitoring for anomalous response sizes or error patterns that could indicate a disclosure attempt. Note that WAF and input-validation controls are unreliable against an out-of-bounds read because the trigger is a perfectly formed request that the runtime mishandles, and that .NET Framework 4.x is not affected by this specific advisory, so it is not a viable downgrade path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 9 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-125 (Out-of-bounds Read), a memory-safety class in which a program indexes past the end (or before the start) of an allocated buffer and returns data that was never intended to be exposed. In the .NET runtime this class of defect typically surfaces in parsing, deserialization, encoding/decoding or interop/native-marshalling code paths where length or offset values derived from attacker-supplied input are not validated before use, causing the runtime to read adjacent heap or stack memory and surface it to the caller. Impact is bounded to information disclosure (C:H with I:N/A:N in the assessed vector), meaning leaked memory could contain sensitive material such as other tenants' data, credentials, tokens or internal memory layout details useful for follow-on exploitation, but the flaw alone does not yield control-flow hijack. The advisory does not enumerate which specific API or component contains the defect, so exposure must be evaluated per application: only workloads that route untrusted network input through the affected component are reachable. The 'Buffer Overflow' and 'Information Disclosure' tags attached by intelligence sources are consistent with an over-read rather than an over-write. No CPE strings were supplied with the source data, so affected platforms must be identified by the .NET and Visual Studio version ranges in the vendor advisory rather than by CPE matching.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network out-of-bounds read reachable without auth or interaction (AV:N/AC:L/PR:N/UI:N); read-only disclosure gives C:H with I:N/A:N and no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
Technical POC Analysis
Evidence caveat: the supplied evidence is the GitHub advisory GHSA-f8qh-mqg4-9939 only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Microsoft's .NET runtime and toolchain contain a memory-disclosure flaw (CVE-2026-96232) that allows an unauthenticated remote attacker to read data beyond intended memory boundaries and return it across the network. The impact is confined to confidentiality-no code execution, privilege escalation, or data modification-but it reaches virtually every .NET-based workload, including internet-facing services and developer environments using Visual Studio 2022 or 2026, so the organization's externally reachable applications and internal build pipelines are broadly in scope. No public exploit has been identified and a vendor patch is available, making this a manageable but time-sensitive prioritization issue.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB