KB5087058: Cumulative update for .NET Framework, versions 3.5 and 4.8.1, on Windows 11 23H2, May 2026. Runtime elevation-of-privilege flaws addressed

Two .NET Framework elevation-of-privilege vulnerabilities, CVE-2026-32177 and CVE-2026-35433, are addressed. A restart is required if affected files are in use.

Does it affect you? Applies to: Devices running Windows 11, version 23H2, with .NET Framework 3.5 or 4.8.1 installed. Packages are available for x64 and Arm64.

What changes

Fixes 2 changes

.NET Framework

2 items

For: Devices with .NET Framework installed

An elevation-of-privilege security vulnerability tracked as CVE-2026-32177 is addressed.¹
An elevation-of-privilege security vulnerability tracked as CVE-2026-35433 is addressed.²

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-05-12
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5082424, KB5066133, KB5064403, KB5056580, KB5049624
Replaced by: KB5101004

Version	File version	Channel
3.5	2.0.50727.9181	General availability
4.8.1	4.8.9334.0	General availability

Security

2 vulnerabilities fixed

2 important

Vulnerability	Severity	CVSS
CVE-2026-32177 .NET Elevation of Privilege Vulnerability	Important	7.3
CVE-2026-35433 .NET Elevation of Privilege Vulnerability	Important	7.3

Downloads (Microsoft Update Catalog)

x64 Windows 11, version 23H2

74.5 MB

windows11.0-kb5087058-x64-ndp481.msu Main update · KB5087058 SHA-1: 94444bf7…2a46b6

Arm64 Windows 11, version 23H2

91.3 MB

windows11.0-kb5087058-arm64-ndp481.msu Main update · KB5087058 SHA-1: eaf4efee…fcbcfa

Updated components

47 files changed since the previous update for the same versions.

Top changed components	Files
WPF	28

Sources

Microsoft Support: KB5087058

Updated Oct 26, 2026

Cited passages from Microsoft's official notes (2)

1. CVE-2026-32177 - .NET Framework Elevation of Privilege vulnerability support.microsoft.com
2. CVE-2026-35433 - .NET Framework Elevation of Privilege vulnerability support.microsoft.com

Checked automatically: 7 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Sep 25, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake