Microsoft .NET Framework 4.8
IMPORTANT Verify that you have installed the required updates listed in the How to get this update section before installing this update.
IMPORTANT Some customers who use Windows Server 2008 R2 SP1 and have activated their ESU multiple activation key (MAK) add-on before installing the January 14, 2020 updates might need to re-activate their key. Re-activation on the affected devices should only be required once. For information on activation, see this blog post.
IMPORTANT WSUS scan cab files will continue to be available for Windows 7 SP1 and Windows Server 2008 R2 SP1. If you have a subset of devices running these operating systems without ESU, they might show as non-compliant in your patch management and compliance toolsets.
IMPORTANT Customers who have purchased the Extended Security Update (ESU) for on-premises versions of these operating systems must follow the procedures in KB4522133 to continue receiving security updates after extended support ends on January 14, 2020. For more information on ESU and which editions are supported, see KB4497181.
IMPORTANT Starting on January 15, 2020, a full-screen notification will appear that describes the risk of continuing to use Windows 7 Service Pack 1 after it reaches end of support on January 14, 2020. The notification will remain on the screen until you interact with it. This notification will only appear on the following editions of Windows 7 Service Pack 1:
- Home Basic.
- Home Premium.
- Professional. If you have purchased the Extended Security Update (ESU), the notification will not appear. For more information, see How to get Extended Security Updates for eligible Windows devices and Lifecycle FAQ-Extended Security Updates.
Note The notification will not appear on domain-joined machines or machines in kiosk mode.
IMPORTANT Starting in August, 2019, updates to .NET Framework 4.6 and above, for Windows Server 2008 R2 SP1, and Windows 7SP1, require SHA-2 Code signing support. Please make sure that you have all the latest Windows Updates before applying this update to avoid installation issues. For more detailed information about SHA-2 code signing support updates, please see KB 4474419.
An elevation of privilege vulnerability exists when ASP.NET or .NET Framework web applications running on IIS improperly allow access to cached files. An attacker who successfully exploited this vulnerability could gain access to restricted files. To exploit this vulnerability, an attacker would need to send a specially crafted request to an affected server. The update addresses the vulnerability by changing how ASP.NET and .NET Framework handle requests.
To learn more about the vulnerabilities, go to the following Common Vulnerabilities and Exposures (CVE).
Quality and reliability improvements
- A change in .NET Framework 4.8 regressed certain EnterpriseServices scenarios where a single-thread apartment object may be treated as a multi-thread apartment and lead to a blocking failure. This change now correctly identifies single-thread apartment objects as such and avoids this failure.
- Addresses an issue in assemblies with IBC profile data causing Ngen worker processes to crash and fall back to full native images.
- Addresses rare crashes that could occur during thread abort delivery.
- SqlBulkCopy.WriteToServer can cause transactions to in-memory SQL tables, to fail. The client may see an exception with message "Execution Timeout Expired. The timeout period elapsed prior to completion of the operation or the server is not responding." SqlBulkCopy.WriteToServer was sending an Attention token (cancellation message) after sending data to SQL Server, causing the server to abort the transaction for in-memory tables.
- Use FIPS-compliant hashes in ASP.Net telemetry data.
- Addresses an issue where "Unspecified" was not an allowed value in config for the 'cookieSameSite' attribute of the forms authentication and session state configuration sections.
- Addresses an issue when spell-checking is enabled in WPF TextBox or RichTextBox, words like “etc.”, “e.g.” are identified as spelling errors incorrectly.
- Addresses an issue when some Per-Monitor Aware WPF applications that run on .NET 4.8 may occasionally encounter a crash with exceptionSystem.ComponentModel.Win32Exception.
- Addresses an issue where TextBlock reflows (makes different line-breaking decisions) during render and hit-test, vs. during measure. The symptoms include missing text, and FailFast crashes during programmatic text processing.
- Addresses an issue with a render thread failure caused by HostVisual disconnecting its target on the wrong thread.
- Addresses an issue with a hang while scrolling a TreeView whose tree is non-uniform, in the sense that a given node's children govern subtrees whose sizes are quite different.
- Addresses an issue with a crash that can occur when closing a tooltip that is re-entrantly closed by user code.
- When an HwndHost leaves the visual tree, a stack trace is created. This is expensive, and usually unnecessary. The logic is now changed to create the stack trace only when the anomalous condition occurs.
- Addresses a memory leak in System.Speech.SpeechSynthesizer.
- DataGrid's Copy command throws an exception if the system clipboard is locked by another process. This crashes, as there is usually no app code on the stack to catch the exception. The behavior of TextBox (and other apps like Notepad, Word, browsers) in this situation is to fail silently - nothing is copied to the clipboard, but no exception. A WPF app can now opt-in to this behavior by setting the following in the app.config file:
- Addresses an issue in constructing the internal model for a FixedPage document. Some text was appearing in the wrong order for the purposes of editing operations such as selection and copy/paste.
- When using a UPN Windows username with the format similar to firstname.lastname@example.org in the username property of a NetworkCredential when using NetTcpBinding or NetNamedPipeBinding, WCF would incorrectly split the username and dns.domain placing them into the UserName and Domain properties. This is invalid in some scenarios and would result in failing to authenticate. This fix removes the credential modification when using a UPN username. The modification can be re-enabled by setting the AppSetting "wcf:enableLegacyUpnUsernameFix" to true.
|Net Libraries|| |
- Addresses a memory leak in HttpListener.
- Addresses an issue with DataGridView IsReadOnlyaccessibility state: Narrator and other accessible tool announces read-only cell status accordingly.
- Addresses a regression in .NET Framework 4.8 when applications using the DataGridView ComboBox cell type and have opted into Level 3 Accessibility, may experience intermittent crashes while editing the cell.
- Addresses an issue in ClickOnce RFC3161 timestamp verification code.
|Winforms Accessibility Improvements|| |
In this release we are adding new accessibility improvements that your application can opt-in into. By default these changes are disabled. Applications that opt-in into accessibility features introduced in .NET 4.8 and earlier, can add the following compatibility switch to the application's config file:
Specifically, if an application targets .NET 4.8, add the following AppContextSwitchOverrides section:
If an application targets an earlier version of the framework and opts in into the previously release sets of accessibility features, then add a single
Winforms accessibility improvements included in this release are:
1 Common Language Runtime (CLR)
2 Windows Presentation Foundation (WPF)
3 Windows Communication Foundation
Known issues in this update
Windows Presentation Framework (WPF) applications that use two or more HostVisual elements belonging to a common thread, where both HostVisual elements are asked to disconnect from their visual target at roughly the same time, mail fail with the following error:
Exception type: System.COMException
Message: UCEERR_RENDERTHREADFAILURE (HRESULT 0x88980406)
Callstack: top frame is System.Windows.Media.Composition.DUCE+Channel.SyncFlush()
You can disable the problematic fix by setting the AppContext switch “Switch.System.Windows.Media.HostVisual.DisconnectsOnWrongThread” to true, using one of the methods described here. This exposes your app to the original bug, so you should remove the switch once a fix is published through an upcoming update.
• Add the following entry to the app.config file to disable the problematic fix in a single application.
Note that if your application configuration already has an entry for <AppContextSwitchOverrides>, you need to add the new setting within that entry, separated from other switches by a semicolon:
<AppContextSwitchOverrides value="Switch.SomeOtherSwitch=true; Switch.System.Windows.Media.HostVisual.DisconnectsOnWrongThread=true"/>
• Apply the following registry subkey to disable the problematic fix for all WPF applications on the machine.
Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft can't guarantee that these problems can be solved. Modify the registry at your own risk.
Note that on 64-bit operating systems, you also need to apply a registry subkey with the same name, type, and value at the location: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\.NETFramework\AppContext\
We are working on a resolution and will provide an update in an upcoming release.
Additional information about this update
- 4570506 Description of the Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 7 SP1 and Windows Server 2008 R2 SP1 (KB4570506)
How to obtain and install the update
Before installing this update
To apply this update, you must have .NET Framework 4.8 installed.
You must install the updates listed below and restart your device before installing the latest Rollup. Installing these updates improves the reliability of the update process and mitigates potential issues while installing the Rollup and applying Microsoft security fixes.
- The March 12, 2019 servicing stack update (SSU) (KB4490628). To get the standalone package for this SSU, search for it in the Microsoft Update Catalog. This update is required to install updates that are only SHA-2 signed.
- The latest SHA-2 update (KB4474419) released September 10, 2019. If you are using Windows Update, the latest SHA-2 update will be offered to you automatically. This update is required to install updates that are only SHA-2 signed. For more information on SHA-2 updates, see 2019 SHA-2 Code Signing Support requirement for Windows and WSUS.
- The Extended Security Updates (ESU) Licensing Preparation Package (KB4538483) released February 11, 2020. The ESU licensing preparation package will be offered to you from WSUS. To get the standalone package for ESU licensing preparation package, search for it in the Microsoft Update Catalog.
Install this update
|Release Channel||Available||Next Step|
|Windows Update and Microsoft Update||Yes||None. This update will be downloaded and installed automatically from Windows Update if you are an ESU customer.|
|Microsoft Update Catalog||Yes||To get the standalone package for this update, go to the Microsoft Update Catalog website.|
|Windows Server Update Services (WSUS)||Yes|| |
This update will automatically sync with WSUS if you configure Products and Classifications as follows:
Product: Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1,Windows Embedded Standard 7 Service Pack 1, Windows Embedded POSReady 7Classification: Security Updates
You must restart the computer after you apply this update if any affected files are being used. We recommend that you exit all .NET Framework-based applications before you apply this update.
Update deployment information
For deployment details for this security update, go to the following article in the Microsoft Knowledge Base:
20200811 Security update deployment information: August 11, 2020
Update removal information
Note We do not recommend that you remove any security update. To remove this update, use the Programs and Features item in Control Panel.
Update restart information
This update does not require a system restart after you apply it unless files that are being updated are locked or are being used.
Update replacement information
This update replaces previously released updates 4566517.