.NET 8.0 has been refreshed with an out-of-band security update as of October 25, 2026. This update is separate from the regular monthly servicing release. See the release notes for details about updated packages.
Important: This out-of-band security update includes additional fixes following the October 13, 2026 security release. Customers using affected products or packages should apply the latest update even if they installed the October 13 security update. See the release notes linked above for vulnerability details and affected platforms and packages.
Security improvements
This update includes fixes for the following vulnerabilities. The platform information describes the fixes included in this release, not the complete affected-version ranges for each vulnerability.
| CVE | Fix | Platform |
|---|---|---|
| CVE-2026-70197 | SocketAsyncEventArgs memory corruption | Windows |
| CVE-2026-114148 | Linux tarball ownership | Linux |
| CVE-2026-111497 | Brotli decoder out-of-bounds write | All platforms using an affected Brotli decoder |
For CVE-2026-114148, the affected distributions are Microsoft-published ASP.NET Core runtime tarballs (including composite runtime tarballs), ASP.NET Core targeting-pack tarballs, and all source-built .NET tarball types on Linux. Ordinary Microsoft-published .NET runtime and SDK tarballs and standalone NuGet packages are not affected by this vulnerability.
How to obtain and install the update
This update is available on Microsoft Update for Windows client operating systems and available on WSUS and MU Catalog for Windows Server operating systems.
Download the update from the .NET 8.0 download page.
Follow the installation guidance for your operating system: Windows, Linux, or macOS.
Prerequisites
Your operating system must be supported by .NET 8.0. Meet the operating-system dependencies described in the installation guidance for your platform.
Update behavior
On Windows, the standalone installers install the new version before removing the previous installation. By default, the previous installation is removed after the update succeeds. Administrators can configure removal to be deferred or disabled. See Choose when previous versions are removed.
With the default removal behavior, installing .NET 8.0.33 replaces .NET 8.0.32 after the update succeeds.
If you use a package manager or a manual installation, follow the update instructions for that installation method. For .NET installations managed by Visual Studio, use the Visual Studio Installer.
Restart Requirement
You may need to restart the computer after you apply this update if any affected files are being used. We recommend that you exit all .NET-based applications before you apply this update.
Supported Windows Versions
See .NET 8.0 supported Windows versions for supported operating systems and architectures.
.NET Support Lifecycle
The .NET Support Policy provides the most up-to-date lifecycle information.
How to obtain help and support for this update
Microsoft Support
For assisted support with .NET technologies, contact a Microsoft Support Professional.
You need to be on a supported servicing level (the latest available servicing update) to be eligible for support.
Community Support
See the .NET Community page for community support.
More Information
To get the latest .NET update, go to the Download .NET website.