Skip to the content
The Update Bureau
.NET Framework 3.5 / 4.8 .NET Framework 3.5 / 4.8 Security update
Patch Tuesday

KB5039889

KB5039889: Cumulative update for .NET Framework, versions 3.5 and 4.8, on Windows Server 2022, July 2024. WinForms memory leaks reduced; privilege escalation addressed

In short

Addresses an elevation-of-privilege vulnerability and reduces WinForms memory leaks. The security fix also changes temporary-path results for SYSTEM processes on Windows versions that expose GetTempPath2.

Does it affect you? Applies to: Windows Server 2022 devices with .NET Framework 3.5 or 4.8 installed.

File version
2.0.50727.9177 · 4.8.4739.0
Security
1 fixed
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • Known issues The security fix changes System.IO.Path.GetTempPath on Windows versions that expose GetTempPath2. For SYSTEM processes, it returns %WINDIR%\SystemTemp, which is inaccessible to non-SYSTEM processes; affected software is expected to adapt.
  • This page The update addresses an issue with the size of memory leaks associated with AccessibleObjects held in memory due to ref-counting.

The official sources are linked at the end of the page.

What changes

Fixes 2 changes

.NET Framework

For: devices with .NET Framework 3.5 or 4.8 installed

  • An elevation-of-privilege vulnerability is addressed.1
    CVE-2024-38081. The security fix changes the return value of System.IO.Path.GetTempPath when the Windows version exposes GetTempPath2.

WinForms

For: applications using WinForms

  • Memory leaks associated with AccessibleObjects held in memory are reduced.2
    Addresses the size of memory leaks associated with ref-counting.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-07-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5037930, KB5036613
Replaced by
KB5044025
VersionFile versionChannel
3.5 2.0.50727.9177 General availability
4.8 4.8.4739.0 General availability

Security

1 vulnerability fixed
1 not rated
VulnerabilitySeverityCVSS
CVE-2024-38081
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
 Not rated —

Downloads (Microsoft Update Catalog)

x64 Windows Server 2022
72.0 MB
windows10.0-kb5039889-x64-ndp48.msu Main update · KB5039889 SHA-1: 0db49392…09c9b3

Updated components

60 files changed since the previous update for the same versions.

Top changed componentsFiles
WPF16
.NET runtime (CLR)14
ASP.NET6
Windows Forms2

Sources

Updated
Cited passages from Microsoft's official notes (2)
  1. 1. CVE-2024-38081 - .NET Framework Elevation of Privilege Vulnerability support.microsoft.com
  2. 2. Addresses an issue with the size of memory leaks associated with AccessibleObjects held in memory due to ref-counting. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake