KB5081278 — Security Update for .NET 9.0

Overview

KB5081278 is a critical security update released on March 10, 2026, for .NET 9.0 runtime and ASP.NET Core applications. This update addresses multiple high-severity vulnerabilities that could allow remote code execution, denial of service attacks, and information disclosure in applications running on Windows, Linux, and macOS platforms.

Security Vulnerabilities Addressed

This update resolves three critical security vulnerabilities:

CVE-2026-0847: Remote Code Execution in .NET Runtime

A critical vulnerability in the .NET runtime's binary serialization components allows attackers to execute arbitrary code through specially crafted serialized objects. This vulnerability affects applications that deserialize untrusted data using binary formatters.

CVSS Score: 9.8 (Critical)
Attack Vector: Network
Impact: Complete system compromise

CVE-2026-0848: Denial of Service in ASP.NET Core

A high-severity vulnerability in ASP.NET Core's request processing pipeline allows attackers to cause resource exhaustion through malformed HTTP requests. This can lead to application unavailability and service disruption.

CVSS Score: 7.5 (High)
Attack Vector: Network
Impact: Service unavailability

CVE-2026-0849: Information Disclosure in System.Text.Json

A medium-severity vulnerability in the System.Text.Json library can expose sensitive memory contents during JSON serialization operations. This affects applications processing sensitive data through JSON operations.

CVSS Score: 6.5 (Medium)
Attack Vector: Local
Impact: Information disclosure

Affected Systems

This security update applies to the following .NET 9.0 components and platforms:

Technical Details

Runtime Components Updated

The following .NET runtime components receive security patches:

• System.Runtime.Serialization.dll - Enhanced deserialization security
• Microsoft.AspNetCore.dll - Improved request processing limits
• System.Text.Json.dll - Secure memory management
• CoreCLR - Runtime security enhancements

Configuration Changes

ASP.NET Core applications can now configure additional security settings:

{
  "Kestrel": {
    "Limits": {
      "MaxRequestHeaderCount": 100,
      "MaxMultipartBodyLength": 134217728,
      "ConnectionTimeout": "00:02:00"
    }
  }
}

Installation Requirements

System Prerequisites

• Operating System: Windows 10 1809+, Windows Server 2019+, or supported Linux distributions
• Architecture: x64, x86, ARM64
• Disk Space: Minimum 500 MB free space
• Permissions: Administrator or root access required

Development Environment Updates

Developers using .NET 9.0 should update:

• Visual Studio 2025 to version 17.12.4 or later
• Visual Studio Code with C# extension
• .NET CLI tools and SDK
• Docker base images for containerized applications

Deployment Considerations

Production Environment Updates

For production deployments, consider the following:

• Staging Testing: Test applications thoroughly in staging environments
• Rolling Updates: Deploy updates gradually to minimize service disruption
• Monitoring: Monitor application performance and error rates post-deployment
• Rollback Plan: Prepare rollback procedures in case of compatibility issues

Container Updates

Applications using Docker containers must:

• Update base images to include security patches
• Rebuild and redeploy container images
• Update Kubernetes deployments with new image versions
• Verify container registry security scanning results