Skip to the content
The Update Bureau
.NET Framework 3.5 / 4.8.1 .NET Framework 3.5 / 4.8.1 Security update
Patch Tuesday

KB5036618

KB5036618: Cumulative update for .NET Framework, versions 3.5 and 4.8.1, on Windows 10 21H2/22H2, April 2024. Remote code execution flaw addressed; .NET reliability issues improved

In short

Addresses CVE-2024-21409, a .NET Framework remote code execution vulnerability, and several reliability and performance issues in ASP.NET, the CLR, and the C# compiler.

Does it affect you? Applies to: Devices running Windows 10 version 21H2 or 22H2 with .NET Framework 3.5 or 4.8.1 installed.

Security
1 fixed
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • What changes The thread-pool issue affects computers with multiple CPU groups.
  • What changes The Interlocked.Read issue affects 32-bit apps and occurs on some computers.

The official sources are linked at the end of the page.

What changes

Fixes 7 changes

.NET Framework

3 items
  • Addresses a remote code execution vulnerability in .NET Framework.1
    CVE-2024-21409.
  • Addresses an issue caused by an outdated version of the OSS zlib library.2
  • Addresses an issue in the AIA fetching process.3

ASP.NET

  • Addresses a performance slowdown in JavaScriptSerializer that appeared after the January Security and Quality update.4

CLR

2 items
  • Addresses an issue that can make thread-pool recycled lists unresponsive on computers with multiple CPU groups.5
    Common Language Runtime (CLR).
  • On some computers, Interlocked.Read calls from 32-bit apps run much slower; this update addresses the issue.6
    Common Language Runtime (CLR).

Compiler

For: Developers using the native C# compiler

  • Addresses a problem compiling code that calls COM interop assemblies with the native C# compiler.7
    The native C# compiler is csc.exe.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-04-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5034466, KB5033918
Replaced by
KB5039893
VersionFile versionChannel
3.5 General availability
4.8.1 General availability

Security

1 vulnerability fixed
1 not rated
VulnerabilitySeverityCVSS
CVE-2024-21409
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
 Not rated —

Downloads (Microsoft Update Catalog)

x64 Windows 10 Enterprise LTSC 2021 / Windows 10, version 22H2
69.9 MB
windows10.0-kb5036618-x64-ndp481.msu Main update · KB5036618 SHA-1: e54bfb45…3b0641
x86 Windows 10 Enterprise LTSC 2021 / Windows 10, version 22H2
44.4 MB
windows10.0-kb5036618-x86-ndp481.msu Main update · KB5036618 SHA-1: ac5d7b78…fd28e3

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. This security update addresses a remote code execution vulnerability detailed in CVE-2024-21409. support.microsoft.com
  2. 2. This security update addresses an issue where version of the OSS zlib library is out of date. support.microsoft.com
  3. 3. This security update addresses an issue in AIA fetching process. support.microsoft.com
  4. 4. Addresses an issue with JavaScriptSerializer where after installing the January Security and Quality update there is a performance degradation. support.microsoft.com
  5. 5. Addresses an issue with thread pool recycled lists become unresponsive on multi-CPU-group computers. support.microsoft.com
  6. 6. Addresses an issue where Interlocked.Read from 32-bit apps are much slower on some computers. support.microsoft.com
  7. 7. Addresses a problem using the native C# compiler (csc.exe) to compile code making calls to COM interop assemblies. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake