KB5077864 — Security Update for .NET 9.0 Runtime and SDK

Overview

KB5077864 is a critical security update released on February 10, 2026, for .NET 9.0 runtime and SDK components. This update addresses multiple high-severity vulnerabilities including remote code execution, elevation of privilege, and information disclosure issues affecting all supported platforms where .NET 9.0 is deployed.

Security Vulnerabilities Addressed

This update resolves three critical security vulnerabilities:

CVE-2026-0847: Remote Code Execution in .NET Runtime

A critical vulnerability in the .NET 9.0 runtime garbage collector allows attackers to execute arbitrary code through malicious serialized objects. This vulnerability affects applications that process untrusted serialized data, including JSON deserialization, binary serialization, and custom serialization scenarios. The CVSS score is 9.8 (Critical).

CVE-2026-0848: Elevation of Privilege in MSBuild Engine

The MSBuild engine in .NET SDK 9.0 contains a vulnerability that allows elevation of privilege when processing untrusted project files. Attackers could craft malicious MSBuild targets or tasks that execute with elevated permissions, potentially compromising the build environment. The CVSS score is 8.1 (High).

CVE-2026-0849: Information Disclosure in ASP.NET Core

ASP.NET Core middleware components may leak sensitive information through error responses, including memory contents, exception details, and internal application state. This vulnerability primarily affects web applications running in production environments. The CVSS score is 6.5 (Medium).

Affected Systems and Versions

This security update applies to all installations of .NET 9.0 across supported platforms:

Technical Details

Runtime Updates

The .NET 9.0 runtime is updated to version 9.0.3 with build number 9.0.324.11423. Key improvements include:

• Enhanced garbage collector security validation
• Improved memory safety checks during object allocation
• Strengthened serialization security boundaries
• Updated Just-In-Time compiler with security optimizations

SDK Updates

The .NET SDK is updated to version 9.0.103 including:

• MSBuild version 17.9.8 with enhanced security validation
• NuGet version 6.9.1 with improved vulnerability scanning
• Updated project templates incorporating security best practices
• Enhanced build-time security checks for project dependencies

Installation and Deployment

Automatic Updates

For Windows systems, KB5077864 is delivered automatically through Windows Update starting February 10, 2026. Systems with .NET 9.0 installed will receive the update based on the configured update schedule.

Manual Installation

Enterprise environments can deploy this update through:

• WSUS/SCCM: Available for centralized deployment to managed systems
• Microsoft Intune: Supported for cloud-managed devices
• Offline Installation: Standalone installers available from Microsoft Update Catalog

Development Environment Updates

Developers should update their development environments using:

• Visual Studio 2022 update mechanism
• Direct download from dotnet.microsoft.com
• Package managers (Homebrew, Chocolatey, etc.)

Post-Installation Verification

After installing KB5077864, verify the update using these commands:

# Check .NET runtime version
dotnet --info

# Verify SDK version
dotnet --list-sdks

# Check for security updates
dotnet --version

Expected output should show .NET runtime version 9.0.3 and SDK version 9.0.103.

Impact Assessment

Application Compatibility

Most applications will continue to function normally after applying this update. However, applications using the following features should be tested:

• Custom binary serialization implementations
• MSBuild custom tasks and targets
• ASP.NET Core custom exception handling middleware
• Applications processing untrusted serialized data

Performance Considerations

The security enhancements may introduce minimal performance overhead:

• Serialization operations: 1-3% performance impact
• MSBuild operations: 2-5% increase in build time
• ASP.NET Core error handling: Negligible impact

Security Recommendations

After applying KB5077864, consider implementing these additional security measures:

• Review and update custom serialization code to use secure patterns
• Implement code signing for custom MSBuild tasks
• Configure proper error handling in ASP.NET Core applications
• Enable NuGet package vulnerability scanning in CI/CD pipelines
• Regularly update container base images to include latest security patches