CVE-2026-83520 · GHSA-4w5f-7jp2-w48g

Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability

Risk score: 82/100
CVSS: 8.8 v3.1
Exploit chance (30 days): 1.3%
Published: 13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
Affected: Microsoft.WindowsDesktop.App.Runtime.win-arm64 (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.WindowsDesktop.App.Runtime.win-x64 (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.WindowsDesktop.App.Runtime.win-x86 (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.WindowsDesktop.Ap…
Fix: Upgrade Microsoft.WindowsDesktop.App.Runtime.win-arm64 to 11.0.0-rc.2 or 10.0.13 or 8.0.32; Microsoft.WindowsDesktop.App.Runtime.win-x64 to 11.0.0-rc.2 or 10.0.13 or 8.0.32; Microsoft.WindowsDesktop.App.Runtime.win-x86 to 11.0.0-rc.2 or 10.0.13 (whichever matches your release line) or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Microsoft.WindowsDesktop.App.Runtime.win-arm64: Red, act today. Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

The flaws

CVE-2026-83520: Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 8.8 · EPSS 1%)
CVE-2026-70035: Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 8.8 · EPSS 1%)
CVE-2026-87697: Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 8.8 · EPSS 1%)
CVE-2026-70174: Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 8.8 · EPSS 1%)

The fix

Fix: Upgrade Microsoft.WindowsDesktop.App.Runtime.win-arm64 to 11.0.0-rc.2 or 10.0.13 or 8.0.32; Microsoft.WindowsDesktop.App.Runtime.win-x64 to 11.0.0-rc.2 or 10.0.13 or 8.0.32; Microsoft.WindowsDesktop.App.Runtime.win-x86 to 11.0.0-rc.2 or 10.0.13 (whichever matches your release line) or later.

Who is exposed: Microsoft.WindowsDesktop.App.Runtime.win-arm64 (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.WindowsDesktop.App.Runtime.win-x64 (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.WindowsDesktop.App.Runtime.win-x86 (nuget) >= 11.0.0-preview.1, <= 11.0.0-rc.1; Microsoft.WindowsDesktop.Ap…

Where it stands

No known exploitation

Connects to

Same weakness: Unsafe deserialisation (CWE-502). 248 other warnings in 30 days

Why it is Red

CVSS 8.8 high
Remotely exploitable without logging in
On your watchlist: .net, NuGet

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
Microsoft.WindowsDesktop.App.Runtime.win-arm64	nuget	>= 11.0.0-preview.1, <= 11.0.0-rc.1	11.0.0-rc.2
Microsoft.WindowsDesktop.App.Runtime.win-x64	nuget	>= 11.0.0-preview.1, <= 11.0.0-rc.1	11.0.0-rc.2
Microsoft.WindowsDesktop.App.Runtime.win-x86	nuget	>= 11.0.0-preview.1, <= 11.0.0-rc.1	11.0.0-rc.2
Microsoft.WindowsDesktop.App.Runtime.win-arm64	nuget	>= 10.0.0, <= 10.0.12	10.0.13
Microsoft.WindowsDesktop.App.Runtime.win-x64	nuget	>= 10.0.0, <= 10.0.12	10.0.13
Microsoft.WindowsDesktop.App.Runtime.win-x86	nuget	>= 10.0.0, <= 10.0.12	10.0.13
Microsoft.WindowsDesktop.App.Runtime.win-arm64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.WindowsDesktop.App.Runtime.win-x64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.WindowsDesktop.App.Runtime.win-x86	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.WindowsDesktop.App.Runtime.win-arm64	nuget	>= 9.0.0, <= 9.0.20	9.0.21
Microsoft.WindowsDesktop.App.Runtime.win-x64	nuget	>= 9.0.0, <= 9.0.20	9.0.21
Microsoft.WindowsDesktop.App.Runtime.win-x86	nuget	>= 9.0.0, <= 9.0.20	9.0.21

References

Original description

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

Last activity 13 Oct 2026. Patch Forecast updates every hour.