CVE-2026-70354 is a high severity (CVSS 7.8) out-of-bounds write in .NET that lets an unauthorized attacker execute code locally. The record also lists .NET Framework and Visual Studio 2022 and 2026. The fix is the set of updates in the Microsoft Security Response Center entry for the products you run.
What's affected
The record lists Microsoft .NET, .NET Framework, Visual Studio 2022 and Visual Studio 2026. It gives no version numbers, and the MSRC page loads by script, so I could not read the build table. Check it for the fixed versions of each product.
The weakness is CWE-787. The vector is AV:L/AC:L/PR:N/UI:R, meaning local access, low complexity, no privileges and a user who has to take an action, with high impact on confidentiality, integrity and availability.
That product list means there are at least three places to patch: the runtime on servers and workstations, the Framework that ships with Windows, and the developer tools on build machines.
How to check if you're exposed
Start with the runtimes and SDKs installed on each machine:
dotnet --list-runtimes
dotnet --list-sdks
For .NET Framework, check Windows updates as described by Microsoft for your Windows version. For Visual Studio, open the Visual Studio Installer, which shows the installed version and any pending update.
Containers need a separate look. A container image pins its own .NET runtime, so patching the host does nothing for it. List the base images your services use and compare their tags with the fixed runtime version. Scanning the image finds the runtime inside it.
free in-browser dependency scan covers the NuGet packages in your project, but runtime and tool versions come from the commands above.
What to do now
- Read the MSRC entry for CVE-2026-70354 and note the fixed version for each product you use.
- Inventory .NET runtimes and SDKs on servers, workstations and build agents.
- Update Visual Studio on developer and build machines through the installer.
- Rebuild and redeploy container images on a patched .NET base image.
- Re-run the inventory to confirm no old runtime remains in use.
Why it matters
CWE-787 is an out-of-bounds write: code writes data past the end of a buffer. Managed languages like C# are designed to prevent this, which is why a write bug in .NET usually lives in the runtime's native components or in native libraries it calls. That makes the runtime itself the thing to patch, not just your code.
Build machines deserve attention. They run code from many sources and hold signing keys and deploy credentials, so local code execution there has a larger reach than on an ordinary workstation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch if I only use .NET in containers?
Yes. Containers carry their own runtime, so update the base image and redeploy. Patching the host does not change the runtime inside the image.
Sources
Last reviewed: 18 October 2026.
