Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-70197 is described as an out-of-bounds write occurring during ReceiveFromAsync when a SocketAsyncEventArgs instance is reused across IPv4 and IPv6 datagram sockets. The core issue is the retention of an undersized cached native address buffer.
My analysis focused on identifying the specific function responsible for initiating this vulnerable operation. By examining the dotnet/runtime repository's source code for System.Net.Sockets.Socket and System.Net.Sockets.SocketAsyncEventArgs, I confirmed that System.Net.Sockets.Socket.ReceiveFromAsync is the method that takes a SocketAsyncEventArgs instance and orchestrates the receive operation, including the handling of the remote endpoint's address.
While Socket.ReceiveFromAsync attempts to serialize the RemoteEndPoint into e._socketAddress and then pins this buffer, the vulnerability description points to a 'cached native address buffer' that remains undersized. This suggests that either the _socketAddress buffer itself, or a related native buffer managed by the underlying Windows API calls (likely initiated by internal ReceiveFromAsyncCore methods), is not being properly re-allocated or re-sized when the SocketAsyncEventArgs instance is reused with a different address family (e.g., from IPv4 to IPv6). This mismatch in buffer size and incoming data size leads to the out-of-bounds write. Therefore, System.Net.Sockets.Socket.ReceiveFromAsync is the function that directly triggers the vulnerable code path.
System.Net.Sockets.Socket.ReceiveFromAsyncsrc/libraries/System.Net.Sockets/src/System/Net/Sockets/Socket.cs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.NETCore.App.Runtime.win-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.win-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.win-x86 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.win-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.win-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.win-x86 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.win-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.win-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.win-x86 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.win-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.win-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.win-x86 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |