Skip to the content
The Update Bureau
.NET Framework 3.5 / 4.8.1 .NET Framework 3.5 / 4.8.1 Security update
Patch Tuesday

KB5082419

KB5082419: Cumulative update for .NET Framework, versions 3.5 and 4.8.1, on Windows 10 21H2/22H2, April 2026. Six security flaws addressed; ARM runtime crash fixed

In short

Addresses six .NET Framework vulnerabilities, including one critical denial-of-service flaw, and fixes an ARM64 runtime crash. Installation might fail through DISM on an offline Windows 10 IoT Enterprise LTSC 21H2 image.

Does it affect you? Applies to: Devices running Windows 10, version 21H2 or 22H2, with .NET Framework 3.5 or 4.8.1 installed. The installation issue concerns offline Windows 10 IoT Enterprise LTSC 21H2 images updated through DISM.

File version
2.0.50727.9181 · 4.8.9332.0
Security
6 fixed · 1 critical
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Known issues The update may fail when DISM is used to apply it to an offline Windows 10 IoT Enterprise LTSC 21H2 image. Microsoft is working on a resolution and plans a fix in an upcoming .NET Framework update.

The official sources are linked at the end of the page.

What changes

Fixes 9 changes

.NET Framework

6 items
  • Addresses a remote code execution vulnerability.1
    CVE-2026-32178.
  • Addresses a denial-of-service vulnerability.2
    CVE-2026-32203.
  • Addresses a denial-of-service vulnerability.3
    CVE-2026-32226.
  • Addresses a critical denial-of-service vulnerability.4
    CVE-2026-23666.
  • Addresses a security feature bypass vulnerability.5
    CVE-2026-26171.
  • Addresses an information disclosure vulnerability.6
    CVE-2026-33116.

.NET Runtime

2 items
  • ClickOnce gets verification support for SHA384 and SHA512.7
    Adds verification logic for ClickOnce to support SHA384 and SHA512.
  • An ARM64 runtime crash is addressed when code generates and catches a NullReferenceException within the same function.8
    The issue affects the ARM64 CLR.

WCF

Verified in package
  • Addresses an issue running a WCF NamedPipe service inside a Win32 app container on Windows 11 or Windows Server 2025.9
    WCF means Windows Communication Foundation.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-04-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5066130, KB5064400
Replaced by
KB5087053
VersionFile versionChannel
3.5 2.0.50727.9181 General availability
4.8.1 4.8.9332.0 General availability

Security

6 vulnerabilities fixed
1 critical 2 important 3 not rated
VulnerabilitySeverityCVSS
CVE-2026-23666
.NET Framework Denial of Service Vulnerability
 Critical 7.5
CVE-2026-33116
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
 Important 7.5
CVE-2026-32226
.NET Framework Denial of Service Vulnerability
 Important 5.9
CVE-2026-26171
.NET Denial of Service Vulnerability
 Not rated —
CVE-2026-32178
.NET Spoofing Vulnerability
 Not rated —
CVE-2026-32203
.NET and Visual Studio Denial of Service Vulnerability
 Not rated —

Downloads (Microsoft Update Catalog)

x64 Windows 10 Enterprise LTSC 2021 / Windows 10, version 22H2
75.8 MB
windows10.0-kb5082419-x64-ndp481.msu Main update · KB5082419 SHA-1: b4ed0502…9e9cd9
x86 Windows 10 Enterprise LTSC 2021 / Windows 10, version 22H2
47.2 MB
windows10.0-kb5082419-x86-ndp481.msu Main update · KB5082419 SHA-1: f81c2607…2d511c

Updated components

76 files changed since the previous update for the same versions.

Top changed componentsFiles
WCF21
.NET runtime (CLR)18
Windows Forms3

Verified in package: changed files confirm WCF.

Sources

Updated
Cited passages from Microsoft's official notes (9)
  1. 1. This security update addresses a remote code execution vulnerability detailed in CVE-2026-32178. support.microsoft.com
  2. 2. This security update addresses a denial-of-service vulnerability detailed in CVE-2026-32203. support.microsoft.com
  3. 3. This security update addresses a denial-of-service vulnerability detailed in CVE-2026-32226. support.microsoft.com
  4. 4. This security update addresses a denial-of-service vulnerability detailed in CVE-2026-23666. support.microsoft.com
  5. 5. This security update addresses a security feature bypass vulnerability detailed in CVE-2026-26171. support.microsoft.com
  6. 6. This security update addresses an information disclosure vulnerability detailed in CVE-2026-33116. support.microsoft.com
  7. 7. Addresses an issue to add verification logic for ClickOnce to support SHA384 and SHA512 support.microsoft.com
  8. 8. Addresses an issue where arm64 CLR could crash when code generates and catches a NullReferenceException within the same function support.microsoft.com
  9. 9. Addresses an issue with running a WCF NamedPipe service inside a Win32 app container when running on Windows 11 or Windows Server 2025. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake