Microsoft has released KB5087054, a cumulative security update for .NET Framework 3.5 and 4.8.1 on Windows 11 Version 24H2, dated May 12, 2026. The x64-only package addresses two security vulnerabilities — an elevation-of-privilege flaw in the .NET Framework runtime (CVE-2026-0234) and an ASP.NET request-validation bypass (CVE-2026-0235) — plus memory-corruption and reliability fixes.
Because .NET Framework 3.5 and 4.8.1 remain the runtime for large numbers of enterprise line-of-business and web applications, the two patched CVEs and the large-object-heap memory-corruption fix make this a security-relevant update — but documented compatibility side effects mean it should be staged before broad rollout.
Key takeaways
- KB5087054 targets .NET Framework 3.5 and 4.8.1 on Windows 11 Version 24H2 (x64) and requires a restart.
- It patches CVE-2026-0234, an elevation-of-privilege flaw in the CLR, and CVE-2026-0235, an ASP.NET security bypass.
- It also fixes large-object-heap memory corruption in the garbage collector and improves reflection performance.
- Known post-install issues include legacy app startup delays, ASP.NET HttpException errors with custom HTTP modules, and high-DPI rendering artifacts.
- Distribution is via Windows Update, Microsoft Update Catalog (~45 MB), and WSUS/SCCM/Intune.
Affected
What KB5087054 does
Microsoft released KB5087054 on May 12, 2026 as a cumulative security update for .NET Framework 3.5 and 4.8.1 on Windows 11 Version 24H2. According to the update documentation, the package applies to x64-based systems on build 26100 or later and requires a restart to complete installation.
The update bundles security fixes with reliability and performance changes. Two of the fixes are tied to CVEs, while the remainder address memory management, reflection performance, and legacy compatibility.
- Released May 12, 2026 for Windows 11 24H2 (x64)
- Applies to .NET Framework 3.5 and 4.8.1
- Restart required; ~45 MB package
Security fixes and key changes
CVE-2026-0234 — CLR elevation of privilege
The update patches an elevation-of-privilege vulnerability in the .NET Framework Common Language Runtime (CLR). Per Microsoft's description, the flaw could let malicious code bypass Code Access Security (CAS) restrictions and run with elevated permissions. The fix strengthens permission checks for partially trusted assemblies and updates mscorlib.dll, System.Security.dll, and clr.dll.
CVE-2026-0235 — ASP.NET security bypass
A security-bypass vulnerability in ASP.NET request validation could allow attackers to inject malicious content via crafted HTTP requests, affecting both Web Forms and MVC applications on .NET Framework 4.8.1. The fix strengthens request-validation filters, improves ViewState input sanitization, and adds validation for HTTP headers and form data.
Reliability and performance
- Fixes memory corruption in the garbage collector affecting large objects (>85KB) on the large object heap in high-memory scenarios.
- Optimizes reflection-heavy workloads using System.Reflection.Emit, reducing CPU and memory overhead.
- Updates the .NET Framework 3.5 compatibility layer, resolving WPF high-DPI rendering, Windows Forms scaling, and COM interop issues.
- CVE-2026-0234 addressed in the CLR
- CVE-2026-0235 addressed in ASP.NET request validation
Who should apply it
The update targets systems running .NET Framework 3.5 and/or 4.8.1 on Windows 11 Version 24H2 x64. Environments most affected by the underlying issues include:
- Enterprise desktop applications built on .NET Framework 3.5 or 4.8.1
- ASP.NET Web Forms and MVC web applications on 4.8.1
- Applications with intensive memory usage or heavy reflection/dynamic code generation
Deployment and verification
KB5087054 is delivered automatically through Windows Update, and is available for manual and enterprise deployment via the Microsoft Update Catalog (approximately 45 MB for x64), WSUS, Microsoft Configuration Manager (SCCM), and Microsoft Intune. Prerequisites include Windows 11 Version 24H2 (build 26100 or later), .NET Framework 3.5 and/or 4.8.1 installed, at least 100 MB free disk space, and administrative privileges.
To confirm the update is installed, administrators can query the hotfix directly in PowerShell:
Get-HotFix -Id KB5087054Stage before production
Microsoft documents several post-install issues. Test applications in a staging environment before deploying to production systems.
- Installation time approximately 5-10 minutes
Known issues after installing
- Legacy .NET Framework 2.0 apps that rely on obsolete APIs may see 2-3 second startup delays.
- ASP.NET web apps using custom HTTP modules may hit HttpException (0x80004005) on certain POST requests.
- Windows Forms apps may show minor rendering artifacts at display scaling above 200%, mainly with custom-drawn or third-party controls.
Documented workarounds include updating app configuration to newer APIs, adjusting request validation in web.config for affected pages, and setting per-monitor DPI awareness in the application manifest.
Timeline
Impact & actions
KB5087054 closes two CVEs and a memory-corruption bug in .NET Framework on Windows 11 24H2 x64, but introduces documented compatibility side effects that require testing.
Security: Patches CVE-2026-0234 (CLR elevation of privilege) and CVE-2026-0235 (ASP.NET security bypass).
Recommended actions · High urgency
- 1Test .NET Framework and ASP.NET applications in staging before production rollout
- 2Deploy KB5087054 to Windows 11 24H2 x64 systems and reboot
- 3Verify installation with Get-HotFix -Id KB5087054
- 4Apply documented workarounds for affected legacy, ASP.NET, and high-DPI apps
Technical details
- CVEs
- CVE-2026-0234, CVE-2026-0235
- Affected versions
- .NET Framework 3.5 on Windows 11 24H2 (x64), .NET Framework 4.8.1 on Windows 11 24H2 (x64)
Mitigations
- Install KB5087054 and restart affected systems
Response
Customer guidance
Microsoft documentation advises installing the update through Windows Update, the Microsoft Update Catalog, or enterprise tools, verifying with Get-HotFix, and testing applications in staging given the listed known issues.
FAQ
What does KB5087054 fix?
It is a cumulative security update for .NET Framework 3.5 and 4.8.1 on Windows 11 Version 24H2 (x64). It patches CVE-2026-0234 (a CLR elevation-of-privilege flaw) and CVE-2026-0235 (an ASP.NET security bypass), and fixes large-object-heap memory corruption in the garbage collector plus reflection-performance and legacy-compatibility issues.
Which systems does KB5087054 apply to?
Windows 11 Version 24H2 x64 systems (build 26100 or later) with .NET Framework 3.5 and/or 4.8.1 installed. A restart is required.
How do I check if KB5087054 is installed?
Run the PowerShell command Get-HotFix -Id KB5087054. It returns the patch details if the update is present.
Are there known issues after installing KB5087054?
Yes. Microsoft documents startup delays for some legacy .NET Framework 2.0 apps, HttpException (0x80004005) errors for ASP.NET apps using custom HTTP modules, and minor rendering artifacts in Windows Forms apps at scaling above 200%. Test in staging before broad deployment.
How is KB5087054 distributed?
Through Windows Update automatically, plus manual and enterprise deployment via the Microsoft Update Catalog (about 45 MB for x64), WSUS, Microsoft Configuration Manager (SCCM), and Microsoft Intune.
The bottom line
KB5087054 is a May 12, 2026 cumulative security update for .NET Framework 3.5 and 4.8.1 on Windows 11 24H2 x64, patching CVE-2026-0234 and CVE-2026-0235 plus garbage-collector and compatibility fixes.
What happens next
What to do
