Today, we are releasing the November 2022 Security and Quality Rollup Updates for .NET Framework.

Security

CVE-2022-41064– .NET Framework Information Disclosure Vulnerability

This security update addresses a vulnerability which exists in System.Data.SqlClient and Microsoft.Data.SqlClient libraries where a timeout occurring under high load can cause incorrect data to be returned as the result of an asynchronously executed query or command.

• CVE-2022-41064

Quality and Reliability

WPF¹

• Addresses an issue where a FailFast crash could occur when using WebBrowser.NavigateToString.
• Addresses an ArgumentOutOfRangeException that can arise when calling ListBox.ScrollIntoView while there are pending changes to the visual tree that will change or clear the underlying ItemsCollection.
• Addresses an ArgumentException “Width and Height must be non-negative” that can arise in an ItemsControl with grouping enabled, custom margins on the GroupItems, collapse/expand of GroupItems enabled, and run in high-DPI.
• Addresses an issue where the opt-out switch Switch.System.Windows.Controls.ToolTip.OptOutOfWCAG21ToolTipBehavior didn’t quite restore the 4.8 behavior, in particular the way it honors Switch.UseLegacyToolTipDisplay (which controls whether keyboard tooltip behavior is enabled).

.NET Runtime

• Address crashes that could occur if ilasm.exe failed to establish temporary PDB file alongside the output file.

¹ Windows Presentation Foundation (WPF)

Getting the Update

The Security and Quality Rollup is available via Windows Update, Windows Server Update Services, and Microsoft Update Catalog. The Security Only Update is available via Windows Server Update Services and Microsoft Update Catalog.

Note: Customers that rely on Windows Update and Windows Server Update Services will automatically receive the .NET Framework version-specific updates. Advanced system administrators can also take use of the below direct Microsoft Update Catalog download links to .NET Framework-specific updates. Before applying these updates, please ensure that you carefully review the .NET Framework version applicability, to ensure that you only install updates on systems where they apply.

The following table is for Windows 10, version 1607 and Windows Server 2016 versions and newer operating systems.

The following table is for earlier Windows and Windows Server versions.

Previous Monthly Rollups

The last few .NET Framework Monthly updates are listed below for your convenience:

• .NET Framework October 2022 Cumulative Update Preview
• .NET Framework October 2022 Security and Quality Rollup
• .NET Framework September 2022 Cumulative Update Preview
• .NET Framework September 2022 Security and Quality Rollup