Microsoft released KB5093447 on May 12, 2026, a security update for .NET 8.0 that patches three vulnerabilities in the runtime and ASP.NET Core. The most severe, CVE-2026-26918, carries a CVSS 9.8 score and allows remote code execution through crafted BinaryFormatter deserialization payloads.
BinaryFormatter has been a known security risk for years, but many legacy .NET applications still use it. This update enforces stricter validation that will reject dangerous payloads, which may break apps that haven't migrated to safer serialization alternatives.
Key takeaways
- CVE-2026-26918: BinaryFormatter RCE (CVSS 9.8) via crafted serialized payloads.
- CVE-2026-26919: ASP.NET Core DoS (CVSS 7.5) through malformed HTTP headers.
- CVE-2026-26920: info disclosure (CVSS 5.3) leaking file paths and stack traces.
- Updates .NET 8.0 to version 8.0.5 (Build 8.0.524.21615) across all platforms.
- Breaking change: BinaryFormatter now rejects dangerous payloads with SerializationException.
Affected
KB5093447 Patches CVSS 9.8 Serialization RCE in .NET 8.0
Microsoft released KB5093447 on May 12, 2026, a security update for .NET 8.0 that patches three CVEs in the runtime and ASP.NET Core. The update brings .NET 8.0 to version 8.0.5 (Build 8.0.524.21615) and affects all platforms: Windows, macOS, and Linux on x64, ARM64, and ARM32 architectures.
CVE-2026-26918 is a CVSS 9.8 RCE in the BinaryFormatter serialization component. Attackers can execute arbitrary code by sending crafted serialized payloads to applications that deserialize untrusted input. CVE-2026-26919 is a CVSS 7.5 ASP.NET Core DoS exploitable through malformed HTTP headers that cause resource exhaustion or crashes. CVE-2026-26920 is a CVSS 5.3 info disclosure leaking sensitive data (file paths, internal state) through error messages.
BinaryFormatter RCE and ASP.NET Core DoS Across All Platforms
CVE-2026-26918 targets BinaryFormatter, a serialization mechanism that Microsoft has been deprecating for years due to its inherent insecurity. Despite deprecation warnings, many legacy .NET apps still use it. The CVSS 9.8 score reflects the remote exploitability and full impact: any .NET 8.0 app that deserializes untrusted binary data is vulnerable to arbitrary code execution.
CVE-2026-26919 threatens every ASP.NET Core web app and API by enabling denial of service through crafted HTTP headers. Attackers can crash application pools or exhaust memory without authentication. The info disclosure flaw (CVE-2026-26920) can leak connection strings, file paths, and stack traces in production, providing reconnaissance data for follow-up attacks.
Affected Platforms and Breaking Changes
All .NET 8.0 installations (versions 8.0.0-8.0.4) on Windows 10/11, Windows Server 2019/2022/2025, macOS 10.15+, and supported Linux distributions. File sizes: 165 MB (Windows x64), 145 MB (macOS), 155 MB (Linux x64). No restart required for runtime-only installs. Application restart needed.
Known issues
Apps using BinaryFormatter with untrusted data will now throw SerializationException for dangerous payloads. ASP.NET Core may reject previously accepted malformed HTTP headers (HTTP 400). Startup time may increase 100-200ms from additional validation. Memory usage may rise 5-10 MB for high-traffic HTTP apps.
Timeline
Impact & actions
Three CVEs across .NET runtime and ASP.NET Core covering remote code execution, denial of service, and information disclosure on all platforms.
Security: CVE-2026-26918 (CVSS 9.8) enables arbitrary code execution through crafted BinaryFormatter payloads. CVE-2026-26919 (CVSS 7.5) causes ASP.NET Core crashes via malformed HTTP requests.
Recommended actions · High urgency
- 1Update .NET 8.0 to version 8.0.5 on all systems.
- 2Audit and remove BinaryFormatter usage with untrusted data.
- 3Test ASP.NET Core apps for HTTP header validation changes.
- 4Rebuild Docker containers with updated .NET 8.0.5 base images.
Technical details
- CVEs
- CVE-2026-26918, CVE-2026-26919, CVE-2026-26920
- CVSS
- 9.8
- Attack vector
- Network (CVE-2026-26918, CVE-2026-26919)
- Affected versions
- .NET 8.0.0 through 8.0.4 (runtime and ASP.NET Core)
- Patched versions
- .NET 8.0.5 (Build 8.0.524.21615)
Mitigations
- Update to .NET 8.0.5 immediately.
- Stop using BinaryFormatter with untrusted data.
- Ensure ASP.NET Core production apps disable detailed error pages.
Response
Vendor
FAQ
What does KB5093447 fix?
Three CVEs: CVE-2026-26918 (BinaryFormatter RCE, CVSS 9.8), CVE-2026-26919 (ASP.NET Core DoS via malformed HTTP headers, CVSS 7.5), and CVE-2026-26920 (info disclosure through error messages, CVSS 5.3). Updates .NET 8.0 to version 8.0.5.
Which platforms are affected?
All .NET 8.0 installations from 8.0.0 through 8.0.4 on Windows 10/11, Windows Server 2019/2022/2025, macOS 10.15+, and supported Linux distributions. Both x64 and ARM64 architectures.
Are there breaking changes?
Yes. Apps using BinaryFormatter with untrusted data will now throw SerializationException for dangerous payloads. ASP.NET Core may return HTTP 400 for previously accepted malformed headers. Startup time may increase 100-200ms. Test before deploying to production.
Does it require a restart?
No restart for runtime-only installations. Running applications must be restarted. Docker containers must be rebuilt with updated base images. Installation takes 2-5 minutes.
The bottom line
KB5093447 patches CVE-2026-26918 (BinaryFormatter RCE, CVSS 9.8), CVE-2026-26919 (ASP.NET Core DoS, CVSS 7.5), and CVE-2026-26920 (info disclosure, CVSS 5.3) in .NET 8.0, updating to version 8.0.5 across Windows, macOS, and Linux.
What happens next
What to do
