.NET 10.0 has been refreshed with an out-of-band security update as of October 25, 2026. This update is separate from the regular monthly servicing release. See the release notes for details about updated packages.
Important: This out-of-band security update includes additional fixes following the October 13, 2026 security release. Customers using affected products or packages should apply the latest update even if they installed the October 13 security update. See the release notes linked above for vulnerability details and affected platforms and packages.
Security improvements
This update includes fixes for the following vulnerabilities. The platform information describes the fixes included in this release, not the complete affected-version ranges for each vulnerability.
| CVE | Fix | Platform |
|---|---|---|
| CVE-2026-70197 | SocketAsyncEventArgs memory corruption | Windows |
| CVE-2026-102870 | Blazor WebAssembly debugger remote code execution | Windows, Linux, and macOS |
| CVE-2026-114148 | Source-build tarball ownership | Linux |
| CVE-2026-111497 | Brotli decoder out-of-bounds write | All platforms using an affected Brotli decoder |
This update corrects BrowserDebugHost packaging for the CVE-2026-102870 security fix.
For this .NET 10 release, CVE-2026-114148 applies only to source-built Linux tarball distributions, not ordinary Microsoft-published .NET runtime or SDK tarballs.
How to obtain and install the update
This update is available on Microsoft Update for Windows client operating systems and available on WSUS and MU Catalog for Windows Server operating systems.
Download the update from the .NET 10.0 download page.
Follow the installation guidance for your operating system: Windows, Linux, or macOS.
Updating the runtime alone does not update an application's NuGet package references. For the affected Blazor WebAssembly packages, follow the package-update guidance in the release notes and security advisory for CVE-2026-102870.
Prerequisites
Your operating system must be supported by .NET 10.0. Meet the operating-system dependencies described in the installation guidance for your platform.
Update behavior
On Windows, the standalone installers install the new version before removing the previous installation. By default, the previous installation is removed after the update succeeds. Administrators can configure removal to be deferred or disabled. See Choose when previous versions are removed.
With the default removal behavior, installing .NET 10.0.14 replaces .NET 10.0.13 after the update succeeds.
If you use a package manager or a manual installation, follow the update instructions for that installation method. For .NET installations managed by Visual Studio, use the Visual Studio Installer.
Restart Requirement
You may need to restart the computer after you apply this update if any affected files are being used. We recommend that you exit all .NET-based applications before you apply this update.
Supported Windows Versions
See .NET 10.0 supported Windows versions for supported operating systems and architectures.
.NET Support Lifecycle
The .NET Support Policy provides the most up-to-date lifecycle information.
How to obtain help and support for this update
Microsoft Support
For assisted support with .NET technologies, contact a Microsoft Support Professional.
You need to be on a supported servicing level (the latest available servicing update) to be eligible for support.
Community Support
See the .NET Community page for community support.
More Information
To get the latest .NET update, go to the Download .NET website.