CVE-2026-70035: Insecure Deserialization Remote Code Execution in Microsoft .NET Framework and .NET Runtime

CVE-2026-70035 represents an untrusted deserialization vulnerability impacting multiple versions of Microsoft .NET, .NET Framework, and Visual Studio. The flaw is registered under CWE-502 and allows an unauthenticated remote attacker to execute arbitrary code within the security context of the victim process. Exploitation relies on forcing a vulnerable application to deserialize a maliciously crafted object stream containing pre-identified gadget chains.

The vulnerability exposes network-facing services, desktop applications, and build pipelines processing untrusted input. Systems that receive serialized data structures over network endpoints or open untrusted file formats incorporating .NET object graphs are directly vulnerable. The attack vector is classified as network-based (AV:N) with low complexity (AC:L), requiring user interaction (UI:R) to complete execution.

Microsoft addressed CVE-2026-70035 in October 2026 security updates across affected runtime versions. Due to the wide usage of .NET serialization constructs in legacy and enterprise web applications, unpatched endpoints face elevated exposure to arbitrary remote code execution.

The underlying root cause stems from incomplete type validation during object graph reconstruction within the standard .NET object deserialization pipeline. When standard object binders reconstruct instance topologies from serialized bytes, they evaluate type metadata included in the payload. If the deserializer lacks a strict type filter or type-limiting binder, arbitrary class instances defined within loaded assemblies can be instantiated.

The process relies on object instantiation side effects. During reconstruction, object fields are initialized, property setters are invoked, and methods tied to lifetime events like finalization or disposed states are executed. Attackers assemble gadget chains consisting of standard framework classes whose member access triggers reflection calls, file manipulations, or process creation operations.

Because .NET object graph reconstruction executes before application-level logic validates business rules, payload execution happens immediately upon deserialization. The lack of restrictive type whitelisting by default in legacy interfaces permits class instantiation outside the application domain target intent.

Vulnerable execution paths occur where deserialization APIs encounter untrusted payload inputs. Applications utilizing binary serialization or polymorphic object binders process object stream type definitions directly. The following code demonstrates the vulnerable pattern where binary object graphs are processed without type restrictions:

// Vulnerable implementation: Deserializing untrusted binary streams without type limits
public object DeserializeUntrustedData(Stream incomingStream)
{
    // Vulnerable pattern: BinaryFormatter or polymorphic deserializer processes raw type hints
    BinaryFormatter formatter = new BinaryFormatter();
    // Object binder is omitted or fails to constrain allowed types
    return formatter.Deserialize(incomingStream);
}

To address this vulnerability, patched implementations enforce strict type binders or migrate away from legacy binary object graph formatters entirely. The remediation introduces strict type constraints or replaces polymorphic object reconstruction with safe data interchange formatters.

// Patched implementation: Enforcing custom SerializationBinder with strict type filtering
public class StrictTypeBinder : SerializationBinder
{
    public override Type BindToType(string assemblyName, string typeName)
    {
        // Explicit whitelist of allowed types for safe deserialization
        if (typeName == "SafeNamespace.ExpectedDataObject")
        {
            return typeof(SafeNamespace.ExpectedDataObject);
        }
        // Reject all unexpected class instantiations to block gadget chains
        throw new SecurityException("Unauthorized type instantiation blocked.");
    }
}
 
public object DeserializeSafely(Stream incomingStream)
{
    BinaryFormatter formatter = new BinaryFormatter();
    formatter.Binder = new StrictTypeBinder(); // Restricts allowed object types
    return formatter.Deserialize(incomingStream);
}

The architectural fix eliminates implicit reflection-based instantiation of arbitrary types during stream processing, preventing the execution of gadget properties during object graph binding.

Exploitation of CVE-2026-70035 requires delivering a crafted serialized payload to an application endpoint or user interface. An attacker identifies target endpoints that accept serialized payloads, such as custom RPC interfaces, legacy ASP.NET session state management components, or file import routines in desktop applications.

The attacker constructs a gadget chain using public or proprietary tools to select framework classes that execute commands upon instantiation or property setting. Common gadgets abuse classes within System.Configuration, System.Data, or System.Diagnostics namespaces that invoke Process.Start or compile code upon property assignment.

Upon receiving the payload, the victim process deserializes the stream. As the runtime processes the object graph, member setters in the gadget chain execute consecutively without requiring explicit calls from the surrounding application code. This results in code execution under the privileges of the hosting process.

The severity of CVE-2026-70035 is derived from the full control granted to an attacker upon execution. The attack yields arbitrary code execution within the security context of the affected process. On server deployments, successful exploitation can result in complete system compromise, credential theft, and access to internal databases.

In client scenarios involving Visual Studio or desktop applications, exploitation requires user interaction (UI:R), such as tricking a user into opening a malicious project or processing an untrusted data file. If executed under an elevated account, the exploit grants administrative rights over the host machine.

The CVSS v3.1 score is evaluated at 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Confidentiality, integrity, and availability impacts are all categorized as High. As of October 2026, the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation requires applying Microsoft official security patches across all affected runtime environments. Operating systems and servers running .NET Framework must receive updates through Windows Update or WSUS. For application deployments utilizing standalone .NET runtimes, target assemblies must be updated to fixed versions (8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2).

Architectural mitigations involve replacing binary and polymorphic serializers with non-polymorphic formats such as System.Text.Json or XmlSerializer configured with explicit contracts. If legacy deserializers cannot be immediately replaced, developers must enforce strict SerializationBinder instances that restrict object resolution to explicitly whitelisted types.

Network defense mechanisms should isolate application endpoints accepting untrusted serialized payloads. Web Application Firewalls (WAF) can inspect inbound HTTP headers and POST bodies for known binary serialization headers to drop unauthorized serialized traffic before processing.