KB5033922: Cumulative update for .NET Framework, versions 3.5 and 4.8.1, on Windows Server 2022, January 2024. Denial-of-service and remote-code-execution flaws addressed
In short
The update addresses 4 vulnerabilities in .NET Framework 3.5 and 4.8.1, including flaws that could disrupt services or let attackers run code remotely.
Does it affect you? Applies to: Windows Server 2022 devices with .NET Framework 3.5 or 4.8.1 installed.
Review notes Additional details from the official release notes (1) Read note
- In short The official page lists five vulnerabilities: four CVEs and a separate remote-code-execution vulnerability affecting the HTTP .NET remoting server channel chain.
The official sources are linked at the end of the page.
What changes
Fixes 5 changes
.NET Framework
5 items
For: Windows Server 2022 devices with .NET Framework 3.5 or 4.8.1
-
The update addresses a flaw that could disrupt a service.1
CVE-2023-36042 is listed as a .NET Framework denial-of-service vulnerability.
-
The update blocks a flaw that could let an attacker get around a security feature.2
Addresses CVE-2024-0056, a .NET Framework security feature bypass vulnerability.
-
The update addresses a flaw that could let an attacker gain higher access.3
Addresses CVE-2024-0057, an elevation-of-privilege vulnerability.
-
The update addresses a flaw that could disrupt a service.4
CVE-2024-21312 is a .NET Framework denial-of-service vulnerability.
-
The update addresses a flaw that could let an attacker run code remotely.5
The flaw affects the HTTP .NET remoting server channel chain.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2024-01-09
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaced by
- KB5036621
| Version | File version | Channel |
|---|---|---|
| 3.5 | 2.0.50727.9176 | General availability |
| 4.8.1 | 4.8.9214.0 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
| Not rated | — | |
|
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
|
Not rated | — |
|
NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
|
Not rated | — |
|
.NET Framework Denial of Service Vulnerability
|
Not rated | — |
Downloads (Microsoft Update Catalog)
x64
Windows Server 2022
61.1 MB
Sources
Updated
Cited passages from Microsoft's official notes (5)
-
1.
CVE-2023-36042 – .NET Framework Denial of Service Vulnerability
support.microsoft.com -
2.
CVE-2024-0056 – .NET Framework Security Feature Bypass Vulnerability
support.microsoft.com -
3.
CVE-2024-0057 – .NET Framework Security Feature Vulnerability
support.microsoft.com -
4.
CVE-2024-21312 – .NET Framework Denial of Service Vulnerability
support.microsoft.com -
5.
This security update addresses a remote code execution vulnerability to HTTP .NET remoting server channel chain.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 4/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake