Skip to the content
The Update Bureau
.NET Framework 3.5 / 4.8 .NET Framework 3.5 / 4.8 Security update
Patch Tuesday

KB5033914

KB5033914: Cumulative update for .NET Framework, versions 3.5 and 4.8, on Windows Server 2022, January 2024. HTTP remoting code-execution flaw and three CVEs addressed

In short

The update addresses three listed vulnerabilities that could bypass a security check, grant excessive access, or disrupt a service, plus a separate code-execution flaw in HTTP .NET remoting.

Does it affect you? Applies to: Windows Server 2022 devices with .NET Framework 3.5 or 4.8 installed.

File version
2.0.50727.9176 · 4.8.4690.0
Security
3 fixed
Restart
Required

What changes

Fixes 4 changes

.NET Framework

3 items

For: Windows Server 2022 devices with .NET Framework 3.5 or 4.8

  • The update addresses a weakness that could let someone get past a security check.1
    CVE-2024-0056 is a .NET Framework security feature bypass vulnerability.
  • The update addresses a weakness that could let someone gain more access than intended.2
    CVE-2024-0057 is a .NET Framework elevation of privilege vulnerability.
  • The update addresses a weakness that could make a service stop responding.3
    CVE-2024-21312 is a .NET Framework denial of service vulnerability.

HTTP .NET remoting server channel chain

For: Windows Server 2022 devices with .NET Framework 3.5 or 4.8

  • The update addresses a weakness in a server communication feature that could let someone run their own code.4
    Addresses a remote code execution vulnerability in the HTTP .NET remoting server channel chain.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-01-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaced by
KB5036613
VersionFile versionChannel
3.5 2.0.50727.9176 General availability
4.8 4.8.4690.0 General availability

Security

3 vulnerabilities fixed
3 not rated
VulnerabilitySeverityCVSS
CVE-2024-0056
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
 Not rated —
CVE-2024-0057
NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
 Not rated —
CVE-2024-21312
.NET Framework Denial of Service Vulnerability
 Not rated —

Downloads (Microsoft Update Catalog)

x64 Windows Server 2022
66.1 MB
windows10.0-kb5033914-x64-ndp48.msu Main update · KB5033914 SHA-1: c1d63ed4…fc9f58

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. This security update addresses a security feature bypass vulnerability detailed in CVE-2024-0056 support.microsoft.com
  2. 2. This security update addresses a elevation of privilege vulnerability detailed in CVE-2024-0057. support.microsoft.com
  3. 3. This security update addresses a denial of service vulnerability detailed in CVE-2024-21312 support.microsoft.com
  4. 4. This security update addresses a remote code execution vulnerability to HTTP .NET remoting server channel chain. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake