Skip to the content
The Update Bureau
.NET Framework 3.5 / 4.8.1 .NET Framework 3.5 / 4.8.1 Security update
Patch Tuesday

KB5033922

KB5033922: Cumulative update for .NET Framework, versions 3.5 and 4.8.1, on Windows Server 2022, January 2024. Denial-of-service and remote-code-execution flaws addressed

In short

The update addresses 4 vulnerabilities in .NET Framework 3.5 and 4.8.1, including flaws that could disrupt services or let attackers run code remotely.

Does it affect you? Applies to: Windows Server 2022 devices with .NET Framework 3.5 or 4.8.1 installed.

File version
2.0.50727.9176 · 4.8.9214.0
Security
4 fixed
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • In short The official page lists five vulnerabilities: four CVEs and a separate remote-code-execution vulnerability affecting the HTTP .NET remoting server channel chain.

The official sources are linked at the end of the page.

What changes

Fixes 5 changes

.NET Framework

5 items

For: Windows Server 2022 devices with .NET Framework 3.5 or 4.8.1

  • The update addresses a flaw that could disrupt a service.1
    CVE-2023-36042 is listed as a .NET Framework denial-of-service vulnerability.
  • The update blocks a flaw that could let an attacker get around a security feature.2
    Addresses CVE-2024-0056, a .NET Framework security feature bypass vulnerability.
  • The update addresses a flaw that could let an attacker gain higher access.3
    Addresses CVE-2024-0057, an elevation-of-privilege vulnerability.
  • The update addresses a flaw that could disrupt a service.4
    CVE-2024-21312 is a .NET Framework denial-of-service vulnerability.
  • The update addresses a flaw that could let an attacker run code remotely.5
    The flaw affects the HTTP .NET remoting server channel chain.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-01-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaced by
KB5036621
VersionFile versionChannel
3.5 2.0.50727.9176 General availability
4.8.1 4.8.9214.0 General availability

Security

4 vulnerabilities fixed
4 not rated
VulnerabilitySeverityCVSS
Not rated —
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
Not rated —
NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
Not rated —
.NET Framework Denial of Service Vulnerability
Not rated —

Downloads (Microsoft Update Catalog)

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. CVE-2023-36042 – .NET Framework Denial of Service Vulnerability support.microsoft.com
  2. 2. CVE-2024-0056 – .NET Framework Security Feature Bypass Vulnerability support.microsoft.com
  3. 3. CVE-2024-0057 – .NET Framework Security Feature Vulnerability support.microsoft.com
  4. 4. CVE-2024-21312 – .NET Framework Denial of Service Vulnerability support.microsoft.com
  5. 5. This security update addresses a remote code execution vulnerability to HTTP .NET remoting server channel chain. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake