The Update BureauKB5082421: Cumulative update for .NET Framework, versions 3.5 and 4.8.1, on Windows 11 26H1, April 2026. Critical denial-of-service flaw addressed; WCF issue fixed
In short
The update addresses six .NET Framework vulnerabilities, including one critical denial-of-service flaw, and a problem running WCF NamedPipe services in Win32 app containers.
Does it affect you? Applies to: Arm64 devices running Windows 11, version 26H1, with .NET Framework 4.8.1 installed.
What changes
Fixes 7 changes
.NET Framework
6 items
-
Addresses a remote code execution vulnerability in .NET Framework.1
CVE-2026-32178.
-
Addresses a denial-of-service vulnerability in .NET Framework.2
CVE-2026-32203.
-
Addresses a denial-of-service vulnerability in .NET Framework.3
CVE-2026-32226.
-
Addresses a denial-of-service vulnerability in .NET Framework.4
CVE-2026-23666. This is the critical vulnerability addressed by the update.
-
Addresses a security feature bypass vulnerability in .NET Framework.5
CVE-2026-26171.
-
Addresses an information disclosure vulnerability in .NET Framework.6
CVE-2026-33116.
WCF
Verified in package
-
Addresses a problem that could affect running a WCF NamedPipe service inside a Win32 app container.7
The issue affects Windows 11 and Windows Server 2025.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-04-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5074837
- Replaced by
- KB5087055
| Version | File version | Channel |
|---|---|---|
| 3.5 | 2.0.50727.9181 | General availability |
| 4.8.1 | 4.8.9333.0 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
.NET Framework Denial of Service Vulnerability
|
Critical | 7.5 |
|
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
|
Important | 7.5 |
|
.NET Framework Denial of Service Vulnerability
|
Important | 5.9 |
|
.NET Denial of Service Vulnerability
|
Not rated | — |
|
.NET Spoofing Vulnerability
|
Not rated | — |
|
.NET and Visual Studio Denial of Service Vulnerability
|
Not rated | — |
Downloads (Microsoft Update Catalog)
Arm64
Windows 11, version 26H1
55.0 MB
Updated components
40 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| WCF | 18 |
Verified in package: changed files confirm WCF.
Sources
Updated
Cited passages from Microsoft's official notes (7)
-
1.
This security update addresses a remote code execution vulnerability detailed in CVE-2026-32178.
support.microsoft.com -
2.
This security update addresses a denial-of-service vulnerability detailed in CVE-2026-32203.
support.microsoft.com -
3.
This security update addresses a denial-of-service vulnerability detailed in CVE-2026-32226.
support.microsoft.com -
4.
This security update addresses a denial-of-service vulnerability detailed in CVE-2026-23666.
support.microsoft.com -
5.
This security update addresses a security feature bypass vulnerability detailed in CVE-2026-26171.
support.microsoft.com -
6.
This security update addresses an information disclosure vulnerability detailed in CVE-2026-33116.
support.microsoft.com -
7.
Addresses an issue with running a WCF NamedPipe service inside a Win32 app container when running on Windows 11 or Windows Server 2025.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Sep 25, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake