The Update BureauKB5036610: Cumulative update for .NET Framework, versions 3.5 and 4.8, on Windows 10 1809 and Windows Server 2019, April 2024. Remote code execution flaw addressed; ASP.NET slowdown tackled
In short
Addresses a .NET Framework remote code execution vulnerability and reliability issues, including an ASP.NET performance drop after the January update.
Does it affect you? Applies to: Devices running Windows 10, version 1809, or Windows Server 2019 with .NET Framework 3.5 or 4.8 installed.
What changes
Fixes 5 changes
.NET Framework
3 items
-
A remote code execution vulnerability in .NET Framework is addressed.1
CVE-2024-21409.
-
An outdated software library version is addressed.2
The update addresses an issue where version of the OSS zlib library is out of date.
-
A problem with an information-fetching process is addressed.3
The update addresses an issue in AIA fetching process.
ASP.NET
Verified in package
-
A performance problem that followed the January security and quality update is addressed.4
The issue affects
JavaScriptSerializer.
CLR
-
On computers with multiple CPU groups, part of the .NET thread pool can become unresponsive; this issue is addressed.5
Addresses an issue with thread pool recycled lists become unresponsive on multi-CPU-group computers.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2024-04-09
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5034624, KB5033911
- Replaced by
- KB5039886
| Version | File version | Channel |
|---|---|---|
| 3.5 | 2.0.50727.9063 | General availability |
| 4.8 | 4.8.4718.0 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
|
Not rated | — |
Downloads (Microsoft Update Catalog)
x64
Windows 10 Enterprise LTSC 2019 / Windows Server 2019
82.2 MB
x86
Windows 10 Enterprise LTSC 2019
48.1 MB
Updated components
99 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| WPF | 30 |
| .NET runtime (CLR) | 12 |
| WCF | 12 |
| ASP.NET | 10 |
Verified in package: changed files confirm ASP.NET.
Sources
Updated
Cited passages from Microsoft's official notes (5)
-
1.
This security update addresses a remote code execution vulnerability detailed in CVE-2024-21409.
support.microsoft.com -
2.
This security update addresses an issue where version of the OSS zlib library is out of date.
support.microsoft.com -
3.
This security update addresses an issue in AIA fetching process.
support.microsoft.com -
4.
Addresses an issue with JavaScriptSerializer where after installing the January Security and Quality update there is a performance degradation.
support.microsoft.com -
5.
Addresses an issue with thread pool recycled lists become unresponsive on multi-CPU-group computers.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake