Skip to the content
The Update Bureau
.NET Framework 3.5 / 4.8.1 .NET Framework 3.5 / 4.8.1 Security update
Patch Tuesday

KB5039907

KB5039907: Cumulative update for .NET Framework, versions 3.5 and 4.8.1, on Windows Server 2022, July 2024. Temporary-path behavior changes alongside a privilege fix

In short

The update fixes an elevation-of-privilege vulnerability in .NET Framework and changes the temporary path returned by System.IO.Path.GetTempPath, which might require affected applications to adapt.

Does it affect you? Applies to: Windows Server 2022 devices with .NET Framework 3.5 or 4.8.1 installed.

File version
2.0.50727.9177 · 4.8.9256.0
Security
1 fixed
Restart
Required

What changes

Fixes 3 changes

.NET Framework

  • An elevation-of-privilege vulnerability in .NET Framework is addressed.1
    CVE-2024-38081.

Winforms

For: Applications using Windows Forms

  • An issue with memory leaks involving AccessibleObjects held in memory is addressed.2
    The issue involves ref-counting.

.NET Fundamentals

For: Applications using X.509 certificates under PPL in Azure AD

  • An issue using X.509 certificates under PPL in Azure AD is addressed.3

Improvement 1 change

System.IO.Path.GetTempPath

For: Applications that use System.IO.Path.GetTempPath

  • Some applications might get a different temporary-folder path. Affected software is expected to change its code to adapt.4
    When the Windows version exposes the GetTempPath2 Win32 API, System.IO.Path.GetTempPath invokes it. For a process running as SYSTEM, it returns %WINDIR%\SystemTemp, which is inaccessible to non-SYSTEM processes.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-07-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5037929, KB5036621
Replaced by
KB5044035
VersionFile versionChannel
3.5 2.0.50727.9177 General availability
4.8.1 4.8.9256.0 General availability

Security

1 vulnerability fixed
1 not rated
VulnerabilitySeverityCVSS
CVE-2024-38081
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
 Not rated —

Downloads (Microsoft Update Catalog)

x64 Windows Server 2022
72.1 MB
windows10.0-kb5039907-x64-ndp481.msu Main update · KB5039907 SHA-1: f8da86f7…af1c30

Updated components

76 files changed since the previous update for the same versions.

Top changed componentsFiles
WPF16
.NET runtime (CLR)14
ASP.NET6
Windows Forms2

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. CVE-2024-38081 - .NET Framework Elevation of Privilege Vulnerability support.microsoft.com
  2. 2. Addresses an issue with the size of memory leaks associated with AccessibleObjects held in memory due to ref-counting. support.microsoft.com
  3. 3. Addresses an issue with x509 certificate use under PPL in Azure AD. support.microsoft.com
  4. 4. The fix changed System.IO.Path.GetTempPath method return value. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake