KB5133965: Overview with user sentiment and feedback
Last Updated October 26, 2026
Probability of successful installation and continued operation of the machine
Overview
KB5133965 is a .NET 9.0 out-of-band security refresh (.NET 9.0.22) released October 25, 2026, following the October 13, 2026 security release. It applies to Windows client and Windows Server systems running .NET 9.0 via Microsoft Update, WSUS, or the Microsoft Update Catalog, and also covers Linux and macOS installations. It is a runtime/SDK update rather than a cumulative Windows update.
General Purpose
- Out-of-band security update that supersedes the October 13, 2026 .NET 9.0 security release, so it should be applied even if that update is already installed.
- Fixes CVE-2026-70197 (SocketAsyncEventArgs memory corruption) affecting Windows.
- Fixes CVE-2026-114148 (Linux tarball ownership), limited to ASP.NET Core and source-built .NET tarballs on Linux.
- Fixes CVE-2026-111497 (Brotli decoder out-of-bounds write) across platforms using an affected Brotli decoder.
- Default behavior replaces .NET 9.0.21 with 9.0.22 after success; restart may be needed if affected files are in use.
General Sentiment
No substantive community discussion was available in the provided data, so reception could not be assessed. Because this is a security-focused servicing update with no reported regressions in the source, it is generally expected to be low-risk to deploy.
Known Issues
Disclaimer: We take measures to ensure that AI-generated content is of the highest possible quality, but we cannot guarantee its accuracy and recommend that users do their own independent research. Generated on 2026-10-26 06:49 PM
