The Update BureauKB5082417: Cumulative update for .NET Framework, versions 3.5 and 4.8.1, on Windows 11 25H2 and Windows Server 2025, April 2026. WCF service issue in app containers addressed
Addresses a .NET Framework issue affecting local communication services in some Windows apps, and fixes six vulnerabilities, including one critical denial-of-service flaw.
Does it affect you? Applies to: Devices running Windows 11, version 25H2, or Windows Server 2025 (Microsoft server operating system, version 24H2), with .NET Framework 3.5 or 4.8.1 installed.
Review notes Additional details from the official release notes (1) Read note
- In detail The update also addresses a remote-code-execution flaw (CVE-2026-32178), denial-of-service flaws (CVE-2026-32203 and CVE-2026-32226), a security-feature-bypass flaw (CVE-2026-26171), and an information-disclosure flaw (CVE-2026-33116).
The official sources are linked at the end of the page.
What changes
Fix 1 change
WCF
For: Devices running Windows 11 or Windows Server 2025 with a WCF NamedPipe service in a Win32 app container
-
An issue affecting local communication services in Windows apps running in an isolated app container is addressed.1
Addresses an issue with running a WCF NamedPipe service inside a Win32 app container on Windows 11 or Windows Server 2025.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-04-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5074828, KB5067931, KB5066128, KB5066131
- Replaced by
- KB5087051
| Version | File version | Channel |
|---|---|---|
| 3.5 | 2.0.50727.9181 | General availability |
| 4.8.1 | 4.8.9333.0 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
.NET Framework Denial of Service Vulnerability
|
Critical | 7.5 |
|
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
|
Important | 7.5 |
|
.NET Framework Denial of Service Vulnerability
|
Important | 5.9 |
|
.NET Denial of Service Vulnerability
|
Not rated | — |
|
.NET Spoofing Vulnerability
|
Not rated | — |
|
.NET and Visual Studio Denial of Service Vulnerability
|
Not rated | — |
Downloads (Microsoft Update Catalog)
Updated components
1,604 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| ASP.NET | 60 |
| WPF | 50 |
| WCF | 46 |
| .NET networking | 28 |
| .NET data access | 22 |
| .NET runtime (CLR) | 20 |
| Windows Forms | 8 |
Verified in package: changed files confirm WCF.
Sources
Cited passages from Microsoft's official notes (1)
-
1.
Addresses an issue with running a WCF NamedPipe service inside a Win32 app container when running on Windows 11 or Windows Server 2025.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 1 quoted passage · compared with Microsoft's page on Sep 25, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 3/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake