CVE-2026-96233

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A denial of service vulnerability (CVE-2026-96233) has been identified in .NET's date and time parsing, which allows an attacker who controls a string passed to DateTime.Parse or DateTime.TryParse to terminate the application process. Microsoft describes the issue as DateTime Hebrew-number parsing reaching outside expected stack bounds.

Per CWE-787: Out-of-bounds Write, the product writes data past the end, or before the beginning, of the intended buffer.

This issue affects every platform .NET 6 runs on, including the End-of-Life .NET 6.0 line covered by NES, and any application that parses dates from untrusted input is exposed, whatever culture it parses with. Only applications running in globalization-invariant mode skip the affected code path. Microsoft's advisory lists the .NET runtime packs for 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: .NET
• Affected packages: Microsoft.NETCore.App (the .NET shared framework and runtime packs; the code is in-box in System.Private.CoreLib, not an opt-in package)
• Affected versions:
  
  • >= 6.0.0 <= 6.0.46
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/runtime
• Published packages: Download .NET (Linux, macOS, and Windows)
• Fixed in: NES for .NET 6.0.47

Vulnerability Info

This High-severity vulnerability is found in the date and time parser in System.Private.CoreLib, which ships in the Microsoft.NETCore.App shared framework. While parsing, DateTimeParse stores the numbers it reads in a small fixed-size stack buffer held by DateTimeRawInfo, sized for three values. Unless the application runs in globalization-invariant mode, characters in the Hebrew block are read as Hebrew numerals, and the path that records them as day numbers did not check how many numbers were already stored. A short crafted string could therefore write past the end of the buffer and corrupt the stack, and the runtime terminates the process.

The fix bounds the buffer. The Hebrew numeral path now fails the parse when the buffer is full, the existing number check uses the same limit, and the buffer itself refuses to write past its end as a backstop. DateTime.TryParse returns false for such input instead of crashing. Because the failure is a process abort rather than an exception, application-level exception handling around parsing does not contain it.

This vulnerability has been present since at least .NET 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • NES for .NET 6.0.47 or later
  • .NET 8.0.32 or later
  • .NET 9.0.21 or later
  • .NET 10.0.13 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

s3zer0, as credited in Microsoft's advisory.