Skip to the content
The Update Bureau
.NET Framework 3.5 / 4.8.1 .NET Framework 3.5 / 4.8.1 Security update
Patch Tuesday

KB5033918

KB5033918: Cumulative update for .NET Framework, versions 3.5 and 4.8.1, on Windows 10 21H2/22H2, January 2024. Denial-of-service and privilege vulnerabilities addressed

In short

The update addresses four vulnerabilities, none rated critical, in .NET Framework. It also addresses a remote code execution vulnerability in an HTTP .NET remoting server channel chain.

Does it affect you? Applies to: Devices running Windows 10 version 21H2 or 22H2 with .NET Framework 3.5 or 4.8.1 installed.

File version
2.0.50727.9176 · 4.8.9214.0
Security
4 fixed
Restart
Required

What changes

Fixes 5 changes

.NET Framework

4 items
  • A .NET Framework denial-of-service vulnerability is addressed.1
    CVE-2023-36042; the update addresses a security feature bypass vulnerability detailed in this CVE.
  • A .NET Framework security feature bypass vulnerability is addressed.2
    CVE-2024-0056.
  • A .NET Framework elevation-of-privilege vulnerability is addressed.3
    CVE-2024-0057.
  • A .NET Framework denial-of-service vulnerability is addressed.4
    CVE-2024-21312.

.NET remoting

  • A remote code execution vulnerability is addressed.5
    The vulnerability affects an HTTP .NET remoting server channel chain.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-01-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaced by
KB5036618
VersionFile versionChannel
3.5 2.0.50727.9176 General availability
4.8.1 4.8.9214.0 General availability

Security

4 vulnerabilities fixed
4 not rated
VulnerabilitySeverityCVSS
CVE-2023-36042
Not rated —
CVE-2024-0056
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
 Not rated —
CVE-2024-0057
NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
 Not rated —
CVE-2024-21312
.NET Framework Denial of Service Vulnerability
 Not rated —

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. CVE-2023-36042 – .NET Framework Denial of Service Vulnerability This security update addresses a security feature bypass vulnerability detailed in CVE-2023-36042. support.microsoft.com
  2. 2. CVE-2024-0056 – .NET Framework Security Feature Bypass Vulnerability This security update addresses a security feature bypass vulnerability detailed in CVE-2024-0056 . support.microsoft.com
  3. 3. CVE-2024-0057 – .NET Framework Security Feature Vulnerability This security update addresses a elevation of privilege vulnerability detailed in CVE-2024-0057. support.microsoft.com
  4. 4. CVE-2024-21312 – .NET Framework Denial of Service Vulnerability This security update addresses a denial of service vulnerability detailed in CVE-2024-21312 . support.microsoft.com
  5. 5. This security update addresses a remote code execution vulnerability to HTTP .NET remoting server channel chain. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake