Key points
- The flaw is an out-of-bounds write in DateTime Hebrew-number parsing.
- It affects .NET Core versions 8 through 11 across Windows, Linux and macOS.
- Microsoft has released patched versions for all affected runtime packages.
Remote attackers can trigger a denial-of-service condition in vulnerable .NET Core applications by exploiting a flaw in date parsing logic. The malicious code causes the application process to terminate unexpectedly. Microsoft classifies this issue as high severity because it requires no authentication and allows network-based exploitation. Developers must update their runtime packages to mitigate the risk of service disruption.
The vulnerability, tracked as CVE-2026-96233, stems from an out-of-bounds write error within the System.Runtime component. According to the GitHub advisory, parsing Hebrew numbers in DateTime objects can cause the code to read outside expected stack bounds. This memory violation leads to immediate process termination. The flaw impacts all supported architectures including x64, arm and arm64 on Windows, Linux and macOS platforms.
What we know
Microsoft released patches for multiple .NET Core versions to address the out-of-bounds write vulnerability. For version 8, the fixed release is 8.0.32, covering builds from 8.0.0 through 8.0.31. Version 9 users must upgrade to 9.0.21, which resolves issues in builds up to 9.0.20. Version 10 requires an update to 10.0.13, fixing versions from 10.0.0 to 10.0.12. Version 11 preview users should move to 11.0.0-rc.2, addressing flaws in preview.1 through rc.1.
This incident follows a pattern of runtime vulnerabilities in the .NET ecosystem. As Malware Chronicle reported on 2026-10-14, Microsoft previously patched a high-severity denial-of-service flaw in ASP.NET Core localization logic. That earlier issue, CVE-2026-96236, affected versions 8 through 11. The current advisory highlights the need for continuous monitoring of runtime dependencies, even when application code remains unchanged.
Defender's checklist
- Identify all .NET Core runtime packages in your project dependencies.
- Verify current versions against the affected ranges for versions 8, 9, 10 and 11.
- Update to the specific patched versions listed in the Microsoft advisory.
- Restart services to ensure the new runtime libraries are loaded correctly.
What analysts watch for
Teams usually monitor for unexpected process terminations in web servers and API hosts. Analysts check whether crash logs reference DateTime parsing or Hebrew number conversion routines. They examine network traffic for requests containing unusual date formats or locale-specific characters. Security teams also review application performance metrics for sudden drops in availability. This behavior indicates potential exploitation of runtime parsing flaws.
What to do and how to stay safe: Microsoft
- Scan your dependency trees for Microsoft.NETCore.App.Runtime packages.
- Compare installed versions against the vulnerable ranges provided by Microsoft.
- Apply the latest patched versions for your specific .NET Core major version.
- Monitor application logs for stack overflow or access violation errors after updates.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-96233?
The vulnerability has a CVSS 3.1 score of 7.5, rated as high severity.
Which platforms are affected by this flaw?
Windows, Linux and macOS are all affected across all supported architectures.
Is there a fix available for .NET Core 11?
Yes, users should update to version 11.0.0-rc.2 or later.
