Microsoft Patches .NET Framework CLR Privilege Escalation and ASP.NET Crashes in KB5082420
The April 2026 cumulative update patches a CLR privilege escalation (CVE-2026-0847), fixes ASP.NET memory corruption under high concurrency, resolves WCF race conditions, boosts Entity Framework performance, and improves ARM64 P/Invoke compatibility.
On this page
Key takeaways
- CVE-2026-0847: CLR privilege escalation to SYSTEM through garbage collector memory corruption.
- ASP.NET heap corruption fix prevents application pool crashes under high-concurrency loads.
- WCF service discovery race condition resolved for Windows 11 24H2's networking stack.
- Entity Framework query optimization for datasets exceeding 10,000 records.
- ARM64 P/Invoke marshaling fixed for native library interop on ARM Windows 11 devices.
What to do now
High urgency- Install KB5082420 on all Windows 11 24H2 systems with .NET Framework.
- Test ASP.NET applications under load after installation.
- Verify WCF service discovery in production.
- Update endpoint protection definitions to avoid false positives.
Microsoft released KB5082420 on April 14, 2026, a cumulative update for .NET Framework 3.5 and 4.8.1 on Windows 11 24H2. The update patches CVE-2026-0847, a critical privilege escalation in the Common Language Runtime garbage collector, and delivers four reliability fixes for ASP.NET, WCF, Entity Framework, and ARM64 platform compatibility.
The CLR vulnerability affects the garbage collector used by every .NET Framework application. Any .NET app running on Windows 11 24H2 is a potential target for escalation to SYSTEM privileges. The ASP.NET and WCF fixes address production stability issues affecting enterprise web and service workloads.
KB5082420 patches a CLR privilege escalation and fixes ASP.NET, WCF, EF, and ARM64 reliability issues in .NET Framework on Windows 11 24H2.
Install KB5082420 on Windows 11 24H2 systems. CVE-2026-0847 enables SYSTEM escalation via the CLR GC. Also fixes ASP.NET crashes, WCF race conditions, EF performance, and ARM64 P/Invoke.
Affected & context
Microsoft released KB5082420 on April 14, 2026, a cumulative update for .NET Framework 3.5 and 4.8.1 on Windows 11 24H2 patching CVE-2026-0847 and four reliability issues.
CVE-2026-0847 targets the CLR GC used by every .NET Framework app. ASP.NET heap corruption crashes production web apps. Both are critical for enterprise environments.
Windows 11 24H2 (x64 and ARM64) systems with .NET Framework 3.5 and/or 4.8.1 installed.
- Vendors
- Microsoft
- Products
- .NET Framework 3.5 (Windows 11 24H2).NET Framework 4.8.1 (Windows 11 24H2)
- CVEs
- CVE-2026-0847
KB5082420 Patches CLR Privilege Escalation and 4 Reliability Flaws in .NET Framework
Microsoft released KB5082420 on April 14, 2026, a cumulative update for .NET Framework 3.5 and 4.8.1 on Windows 11 Version 24H2. The update patches CVE-2026-0847, a critical CLR privilege escalation via the garbage collector's object finalization, and delivers four reliability fixes for ASP.NET, WCF, Entity Framework, and ARM64 P/Invoke marshaling. It applies to both x64 and ARM64 architectures.
CVE-2026-0847 allows attackers to bypass security boundaries during garbage collection and execute code with SYSTEM privileges. The ASP.NET fix addresses heap corruption under high-concurrency request processing that crashed application pools. The WCF fix resolves race conditions in service discovery specific to Windows 11 24H2's networking stack. Entity Framework gets query plan optimization for large datasets (10,000+ records), and ARM64 P/Invoke marshaling now handles calling conventions correctly for native libraries.
CLR Escalation Affects Every .NET Framework App on Windows 11 24H2
CVE-2026-0847 targets the Common Language Runtime garbage collector, a component used by every .NET Framework application. Any app running on .NET Framework 3.5 or 4.8.1 on Windows 11 24H2 is potentially affected. The flaw enables privilege escalation to SYSTEM through memory corruption during object finalization, making it exploitable by malicious code running within the CLR.
The ASP.NET memory corruption is a production reliability issue: high-traffic web apps crash under concurrent load. The WCF race condition breaks service discovery for enterprise SOA applications. The Entity Framework fix matters for data-heavy line-of-business apps, and the ARM64 P/Invoke fix is critical for the growing number of ARM-based Windows 11 deployments running native-interop workloads.
Affected Systems and Known Issues
Windows 11 Version 24H2 (x64 and ARM64) with .NET Framework 3.5 and/or 4.8.1 installed. File size: 85 MB (x64) or 78 MB (ARM64). Restart required. Installation takes 5-10 minutes. Does not apply to Windows 11 23H2, Windows 10, or earlier versions.
Known issues
Legacy .NET Framework 2.0 apps may see a 2-3 second startup delay on first launch (one-time). Visual Studio 2019 may show cosmetic version mismatch warnings during debugging. Some endpoint protection may flag updated assemblies as modified system files.
Timeline
KB5082420 released
Microsoft releases KB5082420 as a cumulative update for .NET Framework 3.5 and 4.8.1 on Windows 11 24H2, patching CVE-2026-0847 and four reliability issues.
Source: Microsoft Support
Confidence: High
Impact
One security CVE and four reliability fixes for .NET Framework 3.5/4.8.1 on Windows 11 24H2 covering CLR escalation, ASP.NET stability, WCF discovery, EF performance, and ARM64 compatibility.
Business impact
CVE-2026-0847 enables SYSTEM escalation via the CLR GC. ASP.NET memory corruption crashes production web apps under load. WCF discovery failures break SOA connectivity.
Security impact
CVE-2026-0847 allows SYSTEM-level privilege escalation through the CLR garbage collector's object finalization routines.
Affected audience: Windows 11 24H2 users running .NET Framework applications, Enterprises with ASP.NET web apps or WCF services, ARM64 Windows 11 device users with native-interop workloads
Action required.
Technical details
- CVEs
- CVE-2026-0847
- Attack vector
- Local (CVE-2026-0847)
- Affected versions
- .NET Framework 3.5 and 4.8.1 on Windows 11 24H2
- Patched versions
- .NET Framework 3.5 and 4.8.1 (post-KB5082420)
Mitigations
- Install KB5082420 immediately.
- Restrict execution of untrusted .NET assemblies.
- Monitor CLR-related security events in Windows Event Log.
Technical references
Response
Vendor statement
Microsoft recommends installing this update on all Windows 11 24H2 systems running .NET Framework workloads.
Response status: Patched
Patch available: Yes
Workaround available: No
FAQ
What does KB5082420 fix?
CVE-2026-0847 (CLR garbage collector privilege escalation to SYSTEM), ASP.NET heap corruption under high concurrency, WCF service discovery race conditions on Windows 11 24H2, Entity Framework query plan optimization for large datasets, and ARM64 P/Invoke marshaling fixes for native library calls.
Which systems need KB5082420?
Windows 11 Version 24H2 (x64 and ARM64) with .NET Framework 3.5 and/or 4.8.1 installed. Does not apply to Windows 11 23H2, Windows 10, or earlier versions.
Are there known issues?
Known issues: legacy .NET 2.0 apps see a 2-3 second first-launch delay (one-time), Visual Studio 2019 shows cosmetic version warnings, and some endpoint protection flags updated assemblies. All have workarounds.
Is this a security update?
Yes. KB5082420 patches CVE-2026-0847, a critical elevation of privilege in the .NET Framework CLR garbage collector that allows SYSTEM-level code execution.
The bottom line
KB5082420 patches CVE-2026-0847 (CLR privilege escalation via GC), fixes ASP.NET heap corruption under concurrency, resolves WCF service discovery race conditions, optimizes Entity Framework for large datasets, and improves ARM64 P/Invoke compatibility.
CVE-2026-0847 affects the CLR garbage collector used by every .NET Framework app. The ASP.NET and WCF fixes address production stability. Install promptly on all Windows 11 24H2 systems running .NET Framework workloads.
What happens next
The companion update KB5082421 covers .NET Framework 4.8.1 on Windows 11 26H1. The May 2026 cumulative update will supersede KB5082420.
What to do
Install KB5082420 and verify with Get-HotFix -Id KB5082420. Test ASP.NET and WCF applications after restart.