KB5133964: Overview with user sentiment and feedback
Last Updated October 28, 2026
Probability of successful installation and continued operation of the machine
Overview
KB5133964 is an out-of-band security refresh for .NET 8.0 dated October 25, 2026, released separately from the regular monthly servicing update. It follows the October 13, 2026 security release and is intended for users of .NET 8.0 on Windows (client and Server via WSUS/MU Catalog), Linux, and macOS. Customers who already installed the October 13 update are advised to apply this one as well.
General Purpose
- Fixes CVE-2026-70197, a SocketAsyncEventArgs memory corruption issue on Windows.
- Fixes CVE-2026-114148, a Linux tarball ownership issue affecting ASP.NET Core runtime/targeting-pack tarballs and source-built .NET tarballs only.
- Fixes CVE-2026-111497, a Brotli decoder out-of-bounds write affecting all platforms using an affected decoder.
- Installs the new version before removing the previous one; default behavior replaces .NET 8.0.32 with 8.0.33 after success.
- May require a restart if affected files are in use; closing .NET applications beforehand is recommended.
General Sentiment
No community discussion or forum reports were available in the crawled data, so reception could not be assessed. The update is a security-focused .NET runtime refresh, which typically carries lower regression risk than feature changes, but this is an inference rather than user-reported evidence.
Known Issues
Disclaimer: We take measures to ensure that AI-generated content is of the highest possible quality, but we cannot guarantee its accuracy and recommend that users do their own independent research. Generated on 2026-10-28 12:51 AM
