Microsoft .NET Framework full changelog

We are releasing this out-of-band (OOB) security update, outside our regular monthly servicing schedule, to address CVE-2026-111497 (Brotli decoder out-of-bounds write). This release also includes a fix for CVE-2026-114148 (Linux .NET tarball ownership). See Notable Changes for applicability and update guidance.

What's Changed:
[release/10.0] Fix InlinedCallFrameMarker bit-0 check on 64-bit platforms in DAC stack walk by @jkotas in #131961
[release/10.0] Fix transition from monomorphic to polymorphic VSD by @AndyAyersMS in #132626
[release/10.0] Source code updates from dotnet/dotnet by @dotnet-maestro[bot] in #132653
[release/10.0] Fix sporadic AccessViolation in compressed single-file apps on Apple Silicon by @elinor-fung in #132710
[release/10.0] Source code updates from dotnet/dotnet by @dotnet-maestro[bot] in #132790
[release/10.0] Update dependencies from dotnet/xharness by @dotnet-maestro[bot] in #132684
[release/10.0] Fix internal Helix queue selection by @jozkee in #132907
[release/10.0] JIT: only imply non-null assertions from exact-type assertions by @EgorBo in #132628
[release/10.0] JIT: don't use a jump-threaded block's sharpened predicate for dominator-based inference by @EgorBo in #132629
[release/10.0] JIT: fix switch peeling stealing the wrong operand of its compare by @EgorBo in #132631
[release/10.0] Source code updates from dotnet/dotnet by @dotnet-maestro[bot] in #132881
[release/10.0] Update dependencies from dotnet/xharness by @dotnet-maestro[bot] in #132961
[release/10.0] Avoid writing jitdump code for block data by @steveisok in #133048
[Release/10.0] Initialize debugger sequence map before binding patches by @hoyosjs in #133073
[release/10.0] Use lock-free reads for ETW rundown versions by @tommcdon in #133084
[release/10.0] Fix profiler spurious/corrupt transition callbacks for reverse P/Invoke marshaling stubs. by @lateralusX in #131928
[release/10.0] Don't pass empty string as SNI to QUIC by @rzikm in #133162
[release/10.0] Detect ephemeral client cert key via SEC_E_UNKNOWN_CREDENTIALS in QUIC by @github-actions[bot] in #132974
[release/10.0] Fix hang in InvalidClientRequestTests by guarding oversized Content-Length cases to managed implementation by @github-actions[bot] in #132782
[release/10.0] Fix concurrent Reflection.Emit TypeLoadException

[release/10.0] [NET] Fix docker compose. by @ManickaP in #126473
[release/10.0] Force MetaDataGetDispenser to be linked into singlefilehost by @github-actions[bot] in #127237
[release/10.0] Fix IJW OverflowException with 17+ by-ref parameters by @github-actions[bot] in #127342
Port 126929 to 10.0 by @mangod9 in #126977
[release/10.0] [QUIC] Update MsQuic by @ManickaP in #126998
[release/10.0] Fix SIGILL crash on ARM64 platforms with SME but no SVE by @github-actions[bot] in #127518
[release/10.0] Add an in-memory cache for CRLs on Linux by @github-actions[bot] in #127574
[release/10.0] Fix off-by-one error in TypePreinit switch instruction handling by @github-actions[bot] in #127587
[release/10.0] Optimize Directory.GetFiles by passing safe patterns to NtQueryDirectoryFile by @jeffhandley in #127974
[release/10.0] Port dump collection perf improvements by @hoyosjs in #128023
[release/10.0] Update dependencies from dotnet/icu by @dotnet-maestro[bot] in #125098

This release includes a fix for CVE-2026-40372
After the Patch Tuesday .NET 10.0.6 release, some customers reported that decryption was failing in their applications. This behavior was reported in aspnetcore issue #66335.
While investigating those reports, we determined that the regression also exposed a vulnerability. In versions 10.0.0 through 10.0.6 of the Microsoft.AspNetCore.DataProtection NuGet package, the managed authenticated encryptor could compute its HMAC validation tag over the wrong bytes of the payload and then discard the computed hash, which could result in elevation of privilege.

.NET 10.0.4 release carries security fixes:
CVE-2026-26127 | .NET Denial of Service Vulnerability:
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0 and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A denial of service vulnerability exists in .NET and Microsoft.Bcl.Memory due to an out-of-bounds read when decoding malformed Base64Url input.
CVE-2026-26130 | .NET Denial of Service Vulnerability:
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A denial of service vulnerability exists in ASP.NET Core due to uncontrolled resource consumption. A specially crafted message to a SignalR server can exhaust an internal buffer and cause a Denial of Service.
CVE-2026-26131 | NET Elevation of Privilege Vulnerability:
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
An elevation of privilege vulnerability exists in .NET due to improper authorization. Incorrect packaging permissions could allow an attacker to gain elevated privileges.

What’s new in .NET 5:
NET 5.0 is the next major release of .NET Core following 3.1. We named this new release .NET 5.0 instead of .NET Core 4.0 for two reasons:
We skipped version numbers 4.x to avoid confusion with .NET Framework 4.x.
We dropped “Core” from the name to emphasize that this is the main implementation of .NET going forward. .NET 5.0 supports more types of apps and more platforms than .NET Core or .NET Framework.
ASP.NET Core 5.0 is based on .NET 5.0 but retains the name “Core” to avoid confusing it with ASP.NET MVC 5. Likewise, Entity Framework Core 5.0 retains the name “Core” to avoid confusing it with Entity Framework 5 and 6.
.NET 5.0 includes the following improvements and new features compared to .NET Core 3.1:
C# updates
F# updates
Visual Basic updates
System.Text.Json new features
Single file apps
App trimming
Windows ARM64 and ARM64 intrinsics
Tooling support for dump debugging
The runtime libraries are 80% annotated for nullable reference types