Microsoft .NET SocketAsyncEventArgs IPv4/IPv6 datagram reuse out-of-bounds write

#Requires -Version 5.1
<#
.SYNOPSIS
  CVE-2026-70197 - .NET SocketAsyncEventArgs OOB Write Checker
.DESCRIPTION
  Checks installed Microsoft.NETCore.App runtimes against the
  October 25, 2026 corrected patch versions (8.0.33, 9.0.22,
  10.0.14, 11.0.0-rc.3.26522.148). Windows-only vulnerability.
  Exit 0 = PATCHED | Exit 1 = VULNERABLE | Exit 2 = UNKNOWN
#>

# Guard: Windows-only CVE
if ($env:OS -ne 'Windows_NT') {
    Write-Host 'PATCHED - CVE-2026-70197 affects Windows only. This host is not Windows.'
    exit 0
}

# Check for dotnet CLI
$dotnetCmd = Get-Command dotnet -ErrorAction SilentlyContinue
if (-not $dotnetCmd) {
    Write-Host 'UNKNOWN - dotnet CLI not found in PATH.'
    Write-Host '          .NET may not be installed, or only self-contained apps are present.'
    Write-Host '          For self-contained apps, check the bundled runtime version manually.'
    exit 2
}

# List installed runtimes
try {
    $lines = & dotnet --list-runtimes 2>&1
    if ($LASTEXITCODE -ne 0) { throw $lines }
} catch {
    Write-Host "UNKNOWN - 'dotnet --list-runtimes' failed: $_"
    exit 2
}

# October 25, 2026 corrected patch versions
$patchMap = @{
    '8'  = [version]'8.0.33'
    '9'  = [version]'9.0.22'
    '10' = [version]'10.0.14'
}

$foundAffectedBranch = $false
$vulnerable          = $false

foreach ($line in $lines) {
    if ($line -match '^Microsoft\.NETCore\.App\s+(\d+)\.(\d+)\.(\d+)') {
        $major = $Matches[1]
        $ver   = [version]"$($Matches[1]).$($Matches[2]).$($Matches[3])"

        if ($patchMap.ContainsKey($major)) {
            $foundAffectedBranch = $true
            $req = $patchMap[$major]
            if ($ver -lt $req) {
                Write-Host "VULNERABLE - .NET $major runtime $ver < required $req"
                $vulnerable = $true
            } else {
                Write-Host "OK         - .NET $major runtime $ver >= $req"
            }
        }
        elseif ($major -eq '11') {
            $foundAffectedBranch = $true
            # .NET 11 preview/RC: patched at rc.3.26522.148
            if ($line -match '(preview\.|rc\.[12]\.)') {
                Write-Host "VULNERABLE - .NET 11 pre-release: $($line.Trim())"
                $vulnerable = $true
            } else {
                Write-Host "OK         - .NET 11 appears at rc.3+ or GA"
            }
        }
        # .NET 6, 7, or other majors: not affected by this CVE
    }
}

if (-not $foundAffectedBranch) {
    Write-Host 'PATCHED - No .NET 8/9/10/11 runtimes found. Only unaffected versions installed.'
    exit 0
}

if ($vulnerable) {
    Write-Host "`nVULNERABLE - One or more .NET runtimes need the October 25, 2026 corrected update."
    Write-Host 'Action: Install .NET 8.0.33 / 9.0.22 / 10.0.14 / 11.0.0-rc.3.26522.148 or later.'
    exit 1
} else {
    Write-Host "`nPATCHED - All detected .NET runtimes at or above corrected patch versions."
    exit 0
}