The Update BureauKB5082426: Cumulative update for .NET Framework, versions 3.5 and 4.8, on Windows 10 21H2/22H2, April 2026. Critical runtime denial-of-service flaw addressed; ClickOnce adds hash support
The update addresses six vulnerabilities, including a critical .NET Framework denial-of-service flaw, and adds SHA384 and SHA512 verification support for ClickOnce. Installation might fail through DISM on offline Windows 10 IoT Enterprise LTSC 21H2 images.
Does it affect you? Applies to: Devices running Windows 10, version 21H2 or 22H2, with .NET Framework 3.5 or 4.8 installed. The update also applies to Windows 10 Enterprise LTSC 2021.
Review notes Additional details from the official release notes (2) Read notes
- What changes The update also addresses CVE-2026-32178, a remote code execution vulnerability, as well as denial-of-service, security feature bypass, and information disclosure vulnerabilities.
- Known issues Installation may fail when this update is applied through DISM to an offline Windows 10 IoT Enterprise LTSC 21H2 image. Microsoft is working on a resolution, with a fix planned for an upcoming .NET Framework update.
The official sources are linked at the end of the page.
What changes
Improvement 1 change
.NET Runtime
For: ClickOnce users
-
ClickOnce verification supports SHA384 and SHA512.1
Adds verification logic for ClickOnce to support SHA384 and SHA512.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-04-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5066135, KB5064399
- Replaced by
- KB5087064
| Version | File version | Channel |
|---|---|---|
| 3.5 | 2.0.50727.9181 | General availability |
| 4.8 | 4.8.4801.0 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
.NET Framework Denial of Service Vulnerability
|
Critical | 7.5 |
|
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
|
Important | 7.5 |
|
.NET Framework Denial of Service Vulnerability
|
Important | 5.9 |
|
.NET Denial of Service Vulnerability
|
Not rated | — |
|
.NET Spoofing Vulnerability
|
Not rated | — |
|
.NET and Visual Studio Denial of Service Vulnerability
|
Not rated | — |
Downloads (Microsoft Update Catalog)
Updated components
51 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| WCF | 21 |
| Windows Forms | 3 |
Sources
Cited passages from Microsoft's official notes (1)
-
1.
Addresses an issue to add verification logic for ClickOnce to support SHA384 and SHA512
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 1 quoted passage · compared with Microsoft's page on Sep 25, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 5/5, clarity 3/5, completeness 3/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake