The Update BureauKB5033909: Cumulative update for .NET Framework, versions 3.5 and 4.8, on Windows 10 21H2/22H2, January 2024. HTTP remoting code-execution flaw addressed
In short
The update addresses three listed CVEs, including flaws that could bypass a security check, raise access, or disrupt a service. It also addresses a code-execution flaw in HTTP remoting.
Does it affect you? Applies to: Devices running Windows 10, versions 21H2 or 22H2, with .NET Framework 3.5 or 4.8 installed.
Review notes Additional details from the official release notes (3) Read notes
- In detail The dossier marks all three CVEs Unrated; it does not establish that they are noncritical.
- In detail The available pages do not establish whether these vulnerabilities were publicly disclosed.
- In detail The available pages do not establish whether these vulnerabilities were exploited.
The official sources are linked at the end of the page.
What changes
Fixes 4 changes
.NET Framework
3 items
-
A flaw that could let someone bypass a security check is addressed.1
Addresses CVE-2024-0056, a security feature bypass vulnerability.
-
A flaw that could let someone gain higher access is addressed.2
Addresses CVE-2024-0057, an elevation of privilege vulnerability.
-
A flaw that could stop a service from responding is addressed.3
Addresses CVE-2024-21312, a denial of service vulnerability.
.NET remoting
-
A flaw that could let someone run code through an HTTP remoting channel is addressed.4
Addresses a remote code execution vulnerability in the HTTP .NET remoting server channel chain.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2024-01-09
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaced by
- KB5036608
| Version | File version | Channel |
|---|---|---|
| 3.5 | 2.0.50727.9176 | General availability |
| 4.8 | 4.8.4690.0 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
|
Not rated | — |
|
NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
|
Not rated | — |
|
.NET Framework Denial of Service Vulnerability
|
Not rated | — |
Downloads (Microsoft Update Catalog)
x64
Windows 10 Enterprise LTSC 2021 / Windows 10, version 22H2
70.2 MB
Arm64
Windows 10 Enterprise LTSC 2021 / Windows 10, version 22H2
45.0 MB
x86
Windows 10 Enterprise LTSC 2021 / Windows 10, version 22H2
45.0 MB
Sources
Updated
Cited passages from Microsoft's official notes (4)
-
1.
CVE-2024-0056 – .NET Framework Security Feature Bypass Vulnerability
support.microsoft.com -
2.
CVE-2024-0057 – .NET Framework Security Feature Vulnerability
support.microsoft.com -
3.
CVE-2024-21312 – .NET Framework Denial of Service Vulnerability
support.microsoft.com -
4.
This security update addresses a remote code execution vulnerability to HTTP .NET remoting server channel chain.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake