[
{
"ghsa_id": "GHSA-4j9v-h7pp-725h",
"cve_id": "CVE-2026-70035",
"url": "https://api.github.com/advisories/GHSA-4j9v-h7pp-725h",
"html_url": "https://github.com/advisories/GHSA-4j9v-h7pp-725h",
"summary": "Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nRestrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigation, add TrueType font protection and XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/451\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`\n\n- **Weakness:** CWE-502 (Deserialization of Untrusted Data)\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-70035](https://www.cve.org/CVERecord?id=CVE-2026-70035)\n\n### Acknowledgements\n\n- Vincent55 Yang (https://vincent55.tw/)\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/wpf/security-advisories/GHSA-4j9v-h7pp-725h",
"source_code_location": "https://github.com/dotnet/wpf",
"identifiers": [
{
"value": "GHSA-4j9v-h7pp-725h",
"type": "GHSA"
},
{
"value": "CVE-2026-70035",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/wpf/security/advisories/GHSA-4j9v-h7pp-725h",
"https://github.com/dotnet/announcements/issues/451",
"https://github.com/dotnet/wpf/issues/12017",
"https://github.com/advisories/GHSA-4j9v-h7pp-725h"
],
"published_at": "2026-10-13T20:53:46Z",
"updated_at": "2026-10-13T20:53:48Z",
"github_reviewed_at": "2026-10-13T20:53:46Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-502",
"name": "Deserialization of Untrusted Data"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
}
},
{
"ghsa_id": "GHSA-mf4x-w4gh-4656",
"cve_id": "CVE-2026-70186",
"url": "https://api.github.com/advisories/GHSA-mf4x-w4gh-4656",
"html_url": "https://github.com/advisories/GHSA-mf4x-w4gh-4656",
"summary": "Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nAn unauthenticated remote attacker can send crafted HTTP/3 reset or abort sequences that deadlock Kestrel connection handling. Repeated requests can cause excessive blocked-thread creation and exhaust server resources, resulting in denial of service.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/461\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n- **Weakness:** CWE-833 (Deadlock)\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS with HTTP/3 support\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-70186](https://www.cve.org/CVERecord?id=CVE-2026-70186)\n\n### Acknowledgements\n\n- Kevin Gosse\n- Muhammad Abdul Rehman\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/aspnetcore/security-advisories/GHSA-mf4x-w4gh-4656",
"source_code_location": "https://github.com/dotnet/aspnetcore",
"identifiers": [
{
"value": "GHSA-mf4x-w4gh-4656",
"type": "GHSA"
},
{
"value": "CVE-2026-70186",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-mf4x-w4gh-4656",
"https://github.com/dotnet/announcements/issues/461",
"https://github.com/dotnet/aspnetcore/discussions/69797",
"https://github.com/advisories/GHSA-mf4x-w4gh-4656"
],
"published_at": "2026-10-13T20:53:19Z",
"updated_at": "2026-10-13T20:53:22Z",
"github_reviewed_at": "2026-10-13T20:53:19Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"score": 7.5
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-833",
"name": "Deadlock"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"score": 7.5
}
},
{
"ghsa_id": "GHSA-pfwj-2f93-rf42",
"cve_id": "CVE-2026-70007",
"url": "https://api.github.com/advisories/GHSA-pfwj-2f93-rf42",
"html_url": "https://github.com/advisories/GHSA-pfwj-2f93-rf42",
"summary": "Microsoft Security Advisory CVE-2026-70007 - .NET and Visual Studio Remote Code Execution Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nCrafted WPF pixel-shader bytecode can desynchronize the two parsing passes in `CPSTrans::Initialize`, causing heap out-of-bounds writes or reads.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/450\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`\n\n- **Weakness:** CWE-787 (Out-of-bounds Write)\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-70007](https://www.cve.org/CVERecord?id=CVE-2026-70007)\n\n### Acknowledgements\n\n- phrolo7a\n- Muhammad Abdul Rehman\n- SOMESH SONUNE\n- Matheus Siqueira\n- thegoldmandm\n- Aobo Wang (@m4x_1997)\n- Mateusz Gierblinski with Curios (https://curios-it.eu/)\n- m0ssser (https://m0ssser-portfolio.pages.dev/)\n- Alex Hannah\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/wpf/security-advisories/GHSA-pfwj-2f93-rf42",
"source_code_location": "https://github.com/dotnet/wpf",
"identifiers": [
{
"value": "GHSA-pfwj-2f93-rf42",
"type": "GHSA"
},
{
"value": "CVE-2026-70007",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/wpf/security/advisories/GHSA-pfwj-2f93-rf42",
"https://github.com/dotnet/announcements/issues/450",
"https://github.com/dotnet/wpf/issues/12016",
"https://github.com/advisories/GHSA-pfwj-2f93-rf42"
],
"published_at": "2026-10-13T20:52:52Z",
"updated_at": "2026-10-13T20:52:54Z",
"github_reviewed_at": "2026-10-13T20:52:52Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-787",
"name": "Out-of-bounds Write"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
}
},
{
"ghsa_id": "GHSA-c27m-942f-rcfh",
"cve_id": "CVE-2026-87697",
"url": "https://api.github.com/advisories/GHSA-c27m-942f-rcfh",
"html_url": "https://github.com/advisories/GHSA-c27m-942f-rcfh",
"summary": "Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nWPF XPS synthetic hyperlinks exposed through UI Automation can bypass restrictive navigation checks and reach attacker-controlled content, enabling remote code execution after user interaction.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/471\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`\n\n- **Weakness:** CWE-502 (Deserialization of Untrusted Data)\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-87697](https://www.cve.org/CVERecord?id=CVE-2026-87697)\n\n### Acknowledgements\n\n- 41ae55e9310ff27fa6f26af4727e5590\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/wpf/security-advisories/GHSA-c27m-942f-rcfh",
"source_code_location": "https://github.com/dotnet/wpf",
"identifiers": [
{
"value": "GHSA-c27m-942f-rcfh",
"type": "GHSA"
},
{
"value": "CVE-2026-87697",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/wpf/security/advisories/GHSA-c27m-942f-rcfh",
"https://github.com/dotnet/announcements/issues/471",
"https://github.com/dotnet/wpf/issues/12021",
"https://github.com/advisories/GHSA-c27m-942f-rcfh"
],
"published_at": "2026-10-13T20:52:24Z",
"updated_at": "2026-10-13T20:52:27Z",
"github_reviewed_at": "2026-10-13T20:52:24Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-502",
"name": "Deserialization of Untrusted Data"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
}
},
{
"ghsa_id": "GHSA-w6wh-p4g7-mpj2",
"cve_id": "CVE-2026-96225",
"url": "https://api.github.com/advisories/GHSA-w6wh-p4g7-mpj2",
"html_url": "https://github.com/advisories/GHSA-w6wh-p4g7-mpj2",
"summary": "Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of Privilege Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.NETCore.App.Runtime; System.Private.CoreLib. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nUnix named-mutex and shared-memory paths can be manipulated through insecure global directories, symlink races, and unsafe permission changes, allowing local attackers to truncate or overwrite files, widen directory permissions, or elevate privileges.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/476\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.8\n- **Vector:** `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n- **Weakness:** CWE-59 (Improper Link Resolution Before File Access ('Link Following'))\n\n## Affected Platforms\n\n- **Platforms:** Linux, macOS\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-96225](https://www.cve.org/CVERecord?id=CVE-2026-96225)\n\n### Acknowledgements\n\n- Weeraphat Srisutham\n- Ky0toFu (@ky0tofu)\n- Leandro Batista\n- Kevin Schmidt\n- Attila.Cs (zerodaybugs.com)\n- Stanley Tobias\n- minhducnguyen03022002@gmail.com with Saigon Newport Corporation\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-w6wh-p4g7-mpj2",
"source_code_location": "https://github.com/dotnet/runtime",
"identifiers": [
{
"value": "GHSA-w6wh-p4g7-mpj2",
"type": "GHSA"
},
{
"value": "CVE-2026-96225",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/runtime/security/advisories/GHSA-w6wh-p4g7-mpj2",
"https://github.com/dotnet/announcements/issues/476",
"https://github.com/dotnet/runtime/issues/135706",
"https://github.com/advisories/GHSA-w6wh-p4g7-mpj2"
],
"published_at": "2026-10-13T20:51:51Z",
"updated_at": "2026-10-13T20:51:54Z",
"github_reviewed_at": "2026-10-13T20:51:51Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"score": 7.8
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-59",
"name": "Improper Link Resolution Before File Access ('Link Following')"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"score": 7.8
}
},
{
"ghsa_id": "GHSA-qjpx-jqm5-h2c4",
"cve_id": "CVE-2026-96230",
"url": "https://api.github.com/advisories/GHSA-qjpx-jqm5-h2c4",
"html_url": "https://github.com/advisories/GHSA-qjpx-jqm5-h2c4",
"summary": "Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nThe Blazor WebAssembly development-server debug page can reflect unencoded exception text, allowing cross-origin script injection through the unauthenticated `/_framework/debug` endpoint used by `dotnet watch`.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/478\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`\n- **Weakness:** CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.AspNetCore.Components.WebAssembly.Server](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Server) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.Components.WebAssembly.Server](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Server) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.Components.WebAssembly.Server](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Server) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.Components.WebAssembly.Server](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Server) | >= 9.0.0, <= 9.0.20 | 9.0.21\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-96230](https://www.cve.org/CVERecord?id=CVE-2026-96230)\n\n### Acknowledgements\n\n- Kevin Gosse\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/aspnetcore/security-advisories/GHSA-qjpx-jqm5-h2c4",
"source_code_location": "https://github.com/dotnet/aspnetcore",
"identifiers": [
{
"value": "GHSA-qjpx-jqm5-h2c4",
"type": "GHSA"
},
{
"value": "CVE-2026-96230",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-qjpx-jqm5-h2c4",
"https://github.com/dotnet/announcements/issues/478",
"https://github.com/dotnet/aspnetcore/discussions/69802",
"https://github.com/advisories/GHSA-qjpx-jqm5-h2c4"
],
"published_at": "2026-10-13T20:51:12Z",
"updated_at": "2026-10-13T20:51:13Z",
"github_reviewed_at": "2026-10-13T20:51:12Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.Components.WebAssembly.Server"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.Components.WebAssembly.Server"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.Components.WebAssembly.Server"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.Components.WebAssembly.Server"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
}
},
{
"ghsa_id": "GHSA-vrrp-6v32-2p8g",
"cve_id": "CVE-2026-70179",
"url": "https://api.github.com/advisories/GHSA-vrrp-6v32-2p8g",
"html_url": "https://github.com/advisories/GHSA-vrrp-6v32-2p8g",
"summary": "Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Authentication.Negotiate. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nASP.NET Core Negotiate LDAP authentication can associate an authenticated identity with an unintended LDAP principal when the LDAP result is not verified against the Kerberos principal SID.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/458\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5\n- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`\n\n- **Weakness:** CWE-290 (Authentication Bypass by Spoofing)\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS when LDAP claim resolution is enabled\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.AspNetCore.Authentication.Negotiate](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.Negotiate) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.Authentication.Negotiate](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.Negotiate) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.Authentication.Negotiate](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.Negotiate) | >= 9.0.0, <= 9.0.20 | 9.0.21\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-70179](https://www.cve.org/CVERecord?id=CVE-2026-70179)\n\n### Acknowledgements\n\n- thegoldmandm\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/aspnetcore/security-advisories/GHSA-vrrp-6v32-2p8g",
"source_code_location": "https://github.com/dotnet/aspnetcore",
"identifiers": [
{
"value": "GHSA-vrrp-6v32-2p8g",
"type": "GHSA"
},
{
"value": "CVE-2026-70179",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-vrrp-6v32-2p8g",
"https://github.com/dotnet/announcements/issues/458",
"https://github.com/dotnet/aspnetcore/discussions/69794",
"https://github.com/advisories/GHSA-vrrp-6v32-2p8g"
],
"published_at": "2026-10-13T20:50:45Z",
"updated_at": "2026-10-13T20:50:46Z",
"github_reviewed_at": "2026-10-13T20:50:45Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.Authentication.Negotiate"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.Authentication.Negotiate"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.Authentication.Negotiate"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"score": 7.5
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"score": 7.5
}
},
{
"ghsa_id": "GHSA-xq57-crx4-g373",
"cve_id": "CVE-2026-96224",
"url": "https://api.github.com/advisories/GHSA-xq57-crx4-g373",
"html_url": "https://github.com/advisories/GHSA-xq57-crx4-g373",
"summary": "Microsoft Security Advisory CVE-2026-96224 - .NET and Visual Studio Remote Code Execution Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nCrafted WPF pixel-shader bytecode can desynchronize the two parsing passes in `CPSTrans::Initialize`, causing heap out-of-bounds writes or reads.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/475\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`\n\n- **Weakness:** CWE-787 (Out-of-bounds Write)\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-96224](https://www.cve.org/CVERecord?id=CVE-2026-96224)\n\n### Acknowledgements\n\n- Aobo Wang (@m4x_1997)\n- kayiz with Lien Phat Technology Corporation\n- Quac Tran\n- Muhammad Abdul Rehman\n- Ky0toFu (@ky0tofu)\n- 41ae55e9310ff27fa6f26af4727e5590\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/wpf/security-advisories/GHSA-xq57-crx4-g373",
"source_code_location": "https://github.com/dotnet/wpf",
"identifiers": [
{
"value": "GHSA-xq57-crx4-g373",
"type": "GHSA"
},
{
"value": "CVE-2026-96224",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/wpf/security/advisories/GHSA-xq57-crx4-g373",
"https://github.com/dotnet/announcements/issues/475",
"https://github.com/dotnet/wpf/issues/12022",
"https://github.com/advisories/GHSA-xq57-crx4-g373"
],
"published_at": "2026-10-13T20:50:11Z",
"updated_at": "2026-10-13T20:50:13Z",
"github_reviewed_at": "2026-10-13T20:50:11Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-787",
"name": "Out-of-bounds Write"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
}
},
{
"ghsa_id": "GHSA-f63g-mx39-3r38",
"cve_id": "CVE-2026-85363",
"url": "https://api.github.com/advisories/GHSA-f63g-mx39-3r38",
"html_url": "https://github.com/advisories/GHSA-f63g-mx39-3r38",
"summary": "Microsoft Security Advisory CVE-2026-85363 - .NET and Visual Studio Remote Code Execution Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nAttacker-controlled XPS glyph coordinates can overflow destination pointer arithmetic in `CD3DGlyphBank::RectFillAlpha`, causing an out-of-bounds write and process termination.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/469\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`\n\n- **Weakness:** CWE-190 (Integer Overflow or Wraparound)\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-85363](https://www.cve.org/CVERecord?id=CVE-2026-85363)\n\n### Acknowledgements\n\n- Ky0toFu (@ky0tofu)\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/wpf/security-advisories/GHSA-f63g-mx39-3r38",
"source_code_location": "https://github.com/dotnet/wpf",
"identifiers": [
{
"value": "GHSA-f63g-mx39-3r38",
"type": "GHSA"
},
{
"value": "CVE-2026-85363",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/wpf/security/advisories/GHSA-f63g-mx39-3r38",
"https://github.com/dotnet/announcements/issues/469",
"https://github.com/dotnet/wpf/issues/12020",
"https://github.com/advisories/GHSA-f63g-mx39-3r38"
],
"published_at": "2026-10-13T20:49:39Z",
"updated_at": "2026-10-13T20:49:41Z",
"github_reviewed_at": "2026-10-13T20:49:39Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-190",
"name": "Integer Overflow or Wraparound"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
}
},
{
"ghsa_id": "GHSA-c399-9853-6jmj",
"cve_id": "CVE-2026-96959",
"url": "https://api.github.com/advisories/GHSA-c399-9853-6jmj",
"html_url": "https://github.com/advisories/GHSA-c399-9853-6jmj",
"summary": "Microsoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nSigned XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/489\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n- **Weakness:** CWE-770 (Allocation of Resources Without Limits or Throttling)\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 8.0.0, <= 8.0.4 | 8.0.5\n[System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 9.0.0, <= 9.0.20 | 9.0.21\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-96959](https://www.cve.org/CVERecord?id=CVE-2026-96959)\n\n### Acknowledgements\n\n- novice-22\n- Ky0toFu (@ky0tofu)\n- Dr.-Ing Ashar Javed (@soaj1664ashar)\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-c399-9853-6jmj",
"source_code_location": "https://github.com/dotnet/runtime",
"identifiers": [
{
"value": "GHSA-c399-9853-6jmj",
"type": "GHSA"
},
{
"value": "CVE-2026-96959",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/runtime/security/advisories/GHSA-c399-9853-6jmj",
"https://github.com/dotnet/announcements/issues/489",
"https://github.com/dotnet/runtime/issues/135710",
"https://github.com/advisories/GHSA-c399-9853-6jmj"
],
"published_at": "2026-10-13T20:49:06Z",
"updated_at": "2026-10-13T20:49:08Z",
"github_reviewed_at": "2026-10-13T20:49:06Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "System.Security.Cryptography.Xml"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "System.Security.Cryptography.Xml"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "System.Security.Cryptography.Xml"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.4",
"first_patched_version": "8.0.5",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "System.Security.Cryptography.Xml"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"score": 7.5
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"score": 7.5
}
},
{
"ghsa_id": "GHSA-4w5f-7jp2-w48g",
"cve_id": "CVE-2026-83520",
"url": "https://api.github.com/advisories/GHSA-4w5f-7jp2-w48g",
"html_url": "https://github.com/advisories/GHSA-4w5f-7jp2-w48g",
"summary": "Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nRestrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigation, add TrueType font protection and XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/467\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`\n\n- **Weakness:** CWE-502 (Deserialization of Untrusted Data)\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-83520](https://www.cve.org/CVERecord?id=CVE-2026-83520)\n\n### Acknowledgements\n\n- Dr.-Ing Ashar Javed (@soaj1664ashar)\n- Vincent55 Yang\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/wpf/security-advisories/GHSA-4w5f-7jp2-w48g",
"source_code_location": "https://github.com/dotnet/wpf",
"identifiers": [
{
"value": "GHSA-4w5f-7jp2-w48g",
"type": "GHSA"
},
{
"value": "CVE-2026-83520",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/wpf/security/advisories/GHSA-4w5f-7jp2-w48g",
"https://github.com/dotnet/announcements/issues/467",
"https://github.com/dotnet/wpf/issues/12019",
"https://github.com/advisories/GHSA-4w5f-7jp2-w48g"
],
"published_at": "2026-10-13T20:48:38Z",
"updated_at": "2026-10-13T20:48:40Z",
"github_reviewed_at": "2026-10-13T20:48:38Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-502",
"name": "Deserialization of Untrusted Data"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
}
},
{
"ghsa_id": "GHSA-f749-vhgx-39h6",
"cve_id": "CVE-2026-70174",
"url": "https://api.github.com/advisories/GHSA-f749-vhgx-39h6",
"html_url": "https://github.com/advisories/GHSA-f749-vhgx-39h6",
"summary": "Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nWPF XPS hyperlink navigation can bypass URI restrictions and reach an attacker-controlled `ObjectDataProvider`, enabling remote code execution after user interaction.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/456\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`\n\n- **Weakness:** CWE-358 (Improperly Implemented Security Check for Standard)\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-70174](https://www.cve.org/CVERecord?id=CVE-2026-70174)\n\n### Acknowledgements\n\n- @bbznop\n- Aobo Wang (@m4x_1997)\n- Rolf Zengafinnen\n- Muhammad Abdul Rehman\n- Kevin Schmidt\n- Leandro Batista\n- nono\n- kayiz with Lien Phat Technology Corporation (http://lp.com.vn/)\n- Ky0toFu (@ky0tofu)\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/wpf/security-advisories/GHSA-f749-vhgx-39h6",
"source_code_location": "https://github.com/dotnet/wpf",
"identifiers": [
{
"value": "GHSA-f749-vhgx-39h6",
"type": "GHSA"
},
{
"value": "CVE-2026-70174",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/wpf/security/advisories/GHSA-f749-vhgx-39h6",
"https://github.com/dotnet/announcements/issues/456",
"https://github.com/dotnet/wpf/issues/12018",
"https://github.com/advisories/GHSA-f749-vhgx-39h6"
],
"published_at": "2026-10-13T20:48:07Z",
"updated_at": "2026-10-13T20:48:08Z",
"github_reviewed_at": "2026-10-13T20:48:07Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
}
},
{
"ghsa_id": "GHSA-f8qh-mqg4-9939",
"cve_id": "CVE-2026-96232",
"url": "https://api.github.com/advisories/GHSA-f8qh-mqg4-9939",
"html_url": "https://github.com/advisories/GHSA-f8qh-mqg4-9939",
"summary": "Microsoft Security Advisory CVE-2026-96232 - .NET and Visual Studio Information Disclosure Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nRestrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigation, add TrueType font protection and XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/480\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`\n\n- **Weakness:** CWE-125 (Out-of-bounds Read)\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-96232](https://www.cve.org/CVERecord?id=CVE-2026-96232)\n\n### Acknowledgements\n\n- Raffaello Tamagnini\n- Aobo Wang (@m4x_1997)\n- Ky0toFu (@ky0tofu)\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/wpf/security-advisories/GHSA-f8qh-mqg4-9939",
"source_code_location": "https://github.com/dotnet/wpf",
"identifiers": [
{
"value": "GHSA-f8qh-mqg4-9939",
"type": "GHSA"
},
{
"value": "CVE-2026-96232",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/wpf/security/advisories/GHSA-f8qh-mqg4-9939",
"https://github.com/dotnet/announcements/issues/480",
"https://github.com/dotnet/wpf/issues/12024",
"https://github.com/advisories/GHSA-f8qh-mqg4-9939"
],
"published_at": "2026-10-13T20:47:31Z",
"updated_at": "2026-10-13T20:47:33Z",
"github_reviewed_at": "2026-10-13T20:47:31Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"score": 7.5
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-125",
"name": "Out-of-bounds Read"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"score": 7.5
}
},
{
"ghsa_id": "GHSA-fq6x-pvr9-888r",
"cve_id": "CVE-2026-96234",
"url": "https://api.github.com/advisories/GHSA-fq6x-pvr9-888r",
"html_url": "https://github.com/advisories/GHSA-fq6x-pvr9-888r",
"summary": "Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nRestrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigation, add TrueType font protection and XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/482\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Moderate\n- **Score:** 5.3\n- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N`\n- **Weakness:** CWE-346 (Origin Validation Error)\n\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-96234](https://www.cve.org/CVERecord?id=CVE-2026-96234)\n\n### Acknowledgements\n\n- nono\n- piropatriot\n- Ali Az\n- Anonymous\n- kayiz with Lien Phat Technology Corporation\n- Muhammad Abdul Rehman\n- Ky0toFu (@ky0tofu)\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "medium",
"repository_advisory_url": "https://api.github.com/repos/dotnet/wpf/security-advisories/GHSA-fq6x-pvr9-888r",
"source_code_location": "https://github.com/dotnet/wpf",
"identifiers": [
{
"value": "GHSA-fq6x-pvr9-888r",
"type": "GHSA"
},
{
"value": "CVE-2026-96234",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/wpf/security/advisories/GHSA-fq6x-pvr9-888r",
"https://github.com/dotnet/announcements/issues/482",
"https://github.com/dotnet/wpf/issues/12025",
"https://github.com/advisories/GHSA-fq6x-pvr9-888r"
],
"published_at": "2026-10-13T20:46:53Z",
"updated_at": "2026-10-13T20:46:56Z",
"github_reviewed_at": "2026-10-13T20:46:53Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"score": 5.3
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-346",
"name": "Origin Validation Error"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"score": 5.3
}
},
{
"ghsa_id": "GHSA-5qr9-xxm9-6cmq",
"cve_id": "CVE-2026-96229",
"url": "https://api.github.com/advisories/GHSA-5qr9-xxm9-6cmq",
"html_url": "https://github.com/advisories/GHSA-5qr9-xxm9-6cmq",
"summary": "Microsoft Security Advisory CVE-2026-96229 - .NET and Visual Studio Information Disclosure Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nRestrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigation, add TrueType font protection and XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/477\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Moderate\n- **Score:** 6.5\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N`\n\n- **Weakness:** CWE-183 (Permissive List of Allowed Inputs)\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-96229](https://www.cve.org/CVERecord?id=CVE-2026-96229)\n\n### Acknowledgements\n\n- Omar Khaleel (@omarkhalil1138)\n- Ali Az\n- nono\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "medium",
"repository_advisory_url": "https://api.github.com/repos/dotnet/wpf/security-advisories/GHSA-5qr9-xxm9-6cmq",
"source_code_location": "https://github.com/dotnet/wpf",
"identifiers": [
{
"value": "GHSA-5qr9-xxm9-6cmq",
"type": "GHSA"
},
{
"value": "CVE-2026-96229",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/wpf/security/advisories/GHSA-5qr9-xxm9-6cmq",
"https://github.com/dotnet/announcements/issues/477",
"https://github.com/dotnet/wpf/issues/12023",
"https://github.com/advisories/GHSA-5qr9-xxm9-6cmq"
],
"published_at": "2026-10-13T20:46:25Z",
"updated_at": "2026-10-13T20:46:28Z",
"github_reviewed_at": "2026-10-13T20:46:25Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"score": 6.5
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-183",
"name": "Permissive List of Allowed Inputs"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"score": 6.5
}
},
{
"ghsa_id": "GHSA-g44w-h65v-4cw9",
"cve_id": "CVE-2026-96235",
"url": "https://api.github.com/advisories/GHSA-g44w-h65v-4cw9",
"html_url": "https://github.com/advisories/GHSA-g44w-h65v-4cw9",
"summary": "Microsoft Security Advisory CVE-2026-96235 - .NET and Visual Studio Remote Code Execution Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nCrafted WPF pixel-shader bytecode can desynchronize the two parsing passes in `CPSTrans::Initialize`, causing heap out-of-bounds writes or reads.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/483\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`\n\n- **Weakness:** CWE-787 (Out-of-bounds Write)\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-96235](https://www.cve.org/CVERecord?id=CVE-2026-96235)\n\n### Acknowledgements\n\n- Mateusz Gierblinski with Curios\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/wpf/security-advisories/GHSA-g44w-h65v-4cw9",
"source_code_location": "https://github.com/dotnet/wpf",
"identifiers": [
{
"value": "GHSA-g44w-h65v-4cw9",
"type": "GHSA"
},
{
"value": "CVE-2026-96235",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/wpf/security/advisories/GHSA-g44w-h65v-4cw9",
"https://github.com/dotnet/announcements/issues/483",
"https://github.com/dotnet/wpf/issues/12026",
"https://github.com/advisories/GHSA-g44w-h65v-4cw9"
],
"published_at": "2026-10-13T20:45:50Z",
"updated_at": "2026-10-13T20:45:52Z",
"github_reviewed_at": "2026-10-13T20:45:50Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-787",
"name": "Out-of-bounds Write"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
}
},
{
"ghsa_id": "GHSA-vrv5-2jg9-4mmr",
"cve_id": "CVE-2026-96222",
"url": "https://api.github.com/advisories/GHSA-vrv5-2jg9-4mmr",
"html_url": "https://github.com/advisories/GHSA-vrv5-2jg9-4mmr",
"summary": "Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\n`KeyInfoX509Data` can accept serialized certificate formats containing attacker-controlled chain metadata instead of requiring a plain X.509 certificate, contributing to certificate-forgery and token-spoofing paths.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/474\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.4\n- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N`\n- **Weakness:** CWE-295 (Improper Certificate Validation)\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 8.0.0, <= 8.0.4 | 8.0.5\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-96222](https://www.cve.org/CVERecord?id=CVE-2026-96222)\n\n### Acknowledgements\n\n- Vaisha Bernard with Eye Security\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-vrv5-2jg9-4mmr",
"source_code_location": "https://github.com/dotnet/runtime",
"identifiers": [
{
"value": "GHSA-vrv5-2jg9-4mmr",
"type": "GHSA"
},
{
"value": "CVE-2026-96222",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/runtime/security/advisories/GHSA-vrv5-2jg9-4mmr",
"https://github.com/dotnet/announcements/issues/474",
"https://github.com/dotnet/runtime/issues/135705",
"https://github.com/advisories/GHSA-vrv5-2jg9-4mmr"
],
"published_at": "2026-10-13T20:45:13Z",
"updated_at": "2026-10-13T20:45:15Z",
"github_reviewed_at": "2026-10-13T20:45:13Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "System.Security.Cryptography.Xml"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.4",
"first_patched_version": "8.0.5",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"score": 7.4
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-295",
"name": "Improper Certificate Validation"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"score": 7.4
}
},
{
"ghsa_id": "GHSA-2j93-m82w-73j2",
"cve_id": "CVE-2026-96231",
"url": "https://api.github.com/advisories/GHSA-2j93-m82w-73j2",
"html_url": "https://github.com/advisories/GHSA-2j93-m82w-73j2",
"summary": "Microsoft Security Advisory CVE-2026-96231 - .NET and Visual Studio Elevation of Privilege Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.NETCore.App.Runtime; System.Private.CoreLib. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nUnix named-mutex and shared-memory paths can be manipulated through insecure global directories, symlink races, and unsafe permission changes, allowing local attackers to truncate or overwrite files, widen directory permissions, or elevate privileges.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/479\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.8\n- **Vector:** `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n- **Weakness:** CWE-59 (Improper Link Resolution Before File Access ('Link Following'))\n\n## Affected Platforms\n\n- **Platforms:** Linux, macOS\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-96231](https://www.cve.org/CVERecord?id=CVE-2026-96231)\n\n### Acknowledgements\n\n- Nguyễn Văn Minh Đức with Saigon Newport Corporation\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-2j93-m82w-73j2",
"source_code_location": "https://github.com/dotnet/runtime",
"identifiers": [
{
"value": "GHSA-2j93-m82w-73j2",
"type": "GHSA"
},
{
"value": "CVE-2026-96231",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/runtime/security/advisories/GHSA-2j93-m82w-73j2",
"https://github.com/dotnet/announcements/issues/479",
"https://github.com/dotnet/runtime/issues/135707",
"https://github.com/advisories/GHSA-2j93-m82w-73j2"
],
"published_at": "2026-10-13T20:44:11Z",
"updated_at": "2026-10-13T20:44:12Z",
"github_reviewed_at": "2026-10-13T20:44:11Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"score": 7.8
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-59",
"name": "Improper Link Resolution Before File Access ('Link Following')"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"score": 7.8
}
},
{
"ghsa_id": "GHSA-2mxg-prvg-9jfg",
"cve_id": "CVE-2026-85790",
"url": "https://api.github.com/advisories/GHSA-2mxg-prvg-9jfg",
"html_url": "https://github.com/advisories/GHSA-2mxg-prvg-9jfg",
"summary": "Microsoft Security Advisory CVE-2026-85790 - .NET Information Disclosure Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.Native.Quic.MsQuic.Schannel. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nVarious vulnerabilities in MsQuic are addressed by an updated native-binary dependency update.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/470\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Moderate\n- **Score:** 5.9\n- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`\n\n- **Weakness:** CWE-416 (Use After Free)\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.Native.Quic.MsQuic.Schannel](https://www.nuget.org/packages/Microsoft.Native.Quic.MsQuic.Schannel) | >= 1.9.0, <= 2.6.1 | 2.6.2\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-85790](https://www.cve.org/CVERecord?id=CVE-2026-85790)\n\n### Acknowledgements\n\n- reinusKR\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "medium",
"repository_advisory_url": "https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-2mxg-prvg-9jfg",
"source_code_location": "https://github.com/dotnet/runtime",
"identifiers": [
{
"value": "GHSA-2mxg-prvg-9jfg",
"type": "GHSA"
},
{
"value": "CVE-2026-85790",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/runtime/security/advisories/GHSA-2mxg-prvg-9jfg",
"https://github.com/dotnet/announcements/issues/470",
"https://github.com/dotnet/runtime/issues/135704",
"https://github.com/advisories/GHSA-2mxg-prvg-9jfg"
],
"published_at": "2026-10-13T20:42:44Z",
"updated_at": "2026-10-13T20:42:46Z",
"github_reviewed_at": "2026-10-13T20:42:44Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.Native.Quic.MsQuic.Schannel"
},
"vulnerable_version_range": ">= 1.9.0, <= 2.6.1",
"first_patched_version": "2.6.2",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"score": 5.9
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-416",
"name": "Use After Free"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"score": 5.9
}
},
{
"ghsa_id": "GHSA-wxxw-5cvc-53j7",
"cve_id": "CVE-2026-66822",
"url": "https://api.github.com/advisories/GHSA-wxxw-5cvc-53j7",
"html_url": "https://github.com/advisories/GHSA-wxxw-5cvc-53j7",
"summary": "Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in System.Net.Http. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nSocketsHttpHandler can retain a `Proxy-Authorization` header across an HTTP redirect and leak basic proxy credentials to the destination server.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/448\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Moderate\n- **Score:** 5.9\n- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`\n- **Weakness:** CWE-201 (Insertion of Sensitive Information Into Sent Data)\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-66822](https://www.cve.org/CVERecord?id=CVE-2026-66822)\n\n### Acknowledgements\n\n- Ky0toFu (@ky0tofu)\n- jhanks\n- Lucas Futures\n- Wenhan Zhou\n- Weeraphat Srisutham\n- Brent Woodard (@crusader_sec) with Crusader Security, LLC (https://crusaderproxy.com/)\n- Kevin Schmidt\n- Piotr Pietruszewski\n- Leandro Batista\n- Raffaello Tamagnini\n- Harkenzo\n- Anonymous\n- Attila.Cs (zerodaybugs.com) with https://zerodaybugs.com/\n- l8BL with ENKI WhiteHat (https://www.enki.co.kr/)\n- caveeroo (https://caveeroo.dev/) with Tarlogic (https://www.tarlogic.com/)\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "medium",
"repository_advisory_url": "https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-wxxw-5cvc-53j7",
"source_code_location": "https://github.com/dotnet/runtime",
"identifiers": [
{
"value": "GHSA-wxxw-5cvc-53j7",
"type": "GHSA"
},
{
"value": "CVE-2026-66822",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/runtime/security/advisories/GHSA-wxxw-5cvc-53j7",
"https://github.com/dotnet/announcements/issues/448",
"https://github.com/dotnet/runtime/issues/135697",
"https://github.com/advisories/GHSA-wxxw-5cvc-53j7"
],
"published_at": "2026-10-13T20:41:40Z",
"updated_at": "2026-10-13T20:41:43Z",
"github_reviewed_at": "2026-10-13T20:41:40Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"score": 5.9
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"score": 5.9
}
},
{
"ghsa_id": "GHSA-rv87-ccxw-8ggf",
"cve_id": "CVE-2026-88092",
"url": "https://api.github.com/advisories/GHSA-rv87-ccxw-8ggf",
"html_url": "https://github.com/advisories/GHSA-rv87-ccxw-8ggf",
"summary": "Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nAn aborted Kestrel HTTP/1 connection can reparse unread request-body bytes as another request, creating a request-smuggling or desynchronization path.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/472\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Critical\n- **Score:** 9.4\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L`\n- **Weakness:** CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-88092](https://www.cve.org/CVERecord?id=CVE-2026-88092)\n\n### Acknowledgements\n\n- thegoldmandm\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "critical",
"repository_advisory_url": "https://api.github.com/repos/dotnet/aspnetcore/security-advisories/GHSA-rv87-ccxw-8ggf",
"source_code_location": "https://github.com/dotnet/aspnetcore",
"identifiers": [
{
"value": "GHSA-rv87-ccxw-8ggf",
"type": "GHSA"
},
{
"value": "CVE-2026-88092",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-rv87-ccxw-8ggf",
"https://github.com/dotnet/announcements/issues/472",
"https://github.com/advisories/GHSA-rv87-ccxw-8ggf"
],
"published_at": "2026-10-13T20:40:50Z",
"updated_at": "2026-10-13T20:40:53Z",
"github_reviewed_at": "2026-10-13T20:40:50Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"score": 9.4
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"score": 9.4
}
},
{
"ghsa_id": "GHSA-fpq8-4vhr-rcxx",
"cve_id": "CVE-2026-70188",
"url": "https://api.github.com/advisories/GHSA-fpq8-4vhr-rcxx",
"html_url": "https://github.com/advisories/GHSA-fpq8-4vhr-rcxx",
"summary": "Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nKestrel accepts newline characters in HTTP/2 request trailers and values retrieved from the dynamic HPACK table instead of treating them as malformed.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/462\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Critical\n- **Score:** 9.1\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`\n- **Weakness:** CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-70188](https://www.cve.org/CVERecord?id=CVE-2026-70188)\n\n### Acknowledgements\n\n- Aayush Atharva\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "critical",
"repository_advisory_url": "https://api.github.com/repos/dotnet/aspnetcore/security-advisories/GHSA-fpq8-4vhr-rcxx",
"source_code_location": "https://github.com/dotnet/aspnetcore",
"identifiers": [
{
"value": "GHSA-fpq8-4vhr-rcxx",
"type": "GHSA"
},
{
"value": "CVE-2026-70188",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-fpq8-4vhr-rcxx",
"https://github.com/dotnet/announcements/issues/462",
"https://github.com/dotnet/aspnetcore/discussions/69798",
"https://github.com/advisories/GHSA-fpq8-4vhr-rcxx"
],
"published_at": "2026-10-13T20:37:27Z",
"updated_at": "2026-10-13T20:37:31Z",
"github_reviewed_at": "2026-10-13T20:37:27Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"score": 9.1
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"score": 9.1
}
},
{
"ghsa_id": "GHSA-f4g7-52wc-p8x7",
"cve_id": "CVE-2026-96236",
"url": "https://api.github.com/advisories/GHSA-f4g7-52wc-p8x7",
"html_url": "https://github.com/advisories/GHSA-f4g7-52wc-p8x7",
"summary": "Microsoft Security Advisory CVE-2026-96236 - ASP.NET Core Denial of Service Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Localization. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nASP.NET Core request-localization fallback can add attacker-supplied synthetic culture names to the runtime's global cache, allowing unauthenticated requests to cause unbounded memory growth and denial of service.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/484\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n- **Weakness:** CWE-770 (Allocation of Resources Without Limits or Throttling)\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-96236](https://www.cve.org/CVERecord?id=CVE-2026-96236)\n\n### Acknowledgements\n\n- Kevin Schmidt\n- kayiz with Lien Phat Technology Corporation\n- Leandro Batista\n- Rolf Zengafinnen\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/aspnetcore/security-advisories/GHSA-f4g7-52wc-p8x7",
"source_code_location": "https://github.com/dotnet/aspnetcore",
"identifiers": [
{
"value": "GHSA-f4g7-52wc-p8x7",
"type": "GHSA"
},
{
"value": "CVE-2026-96236",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-f4g7-52wc-p8x7",
"https://github.com/dotnet/announcements/issues/484",
"https://github.com/dotnet/aspnetcore/discussions/69803",
"https://github.com/advisories/GHSA-f4g7-52wc-p8x7"
],
"published_at": "2026-10-13T20:36:22Z",
"updated_at": "2026-10-13T20:36:25Z",
"github_reviewed_at": "2026-10-13T20:36:22Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"score": 7.5
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"score": 7.5
}
},
{
"ghsa_id": "GHSA-4mpw-cpwj-hxxj",
"cve_id": "CVE-2026-70197",
"url": "https://api.github.com/advisories/GHSA-4mpw-cpwj-hxxj",
"html_url": "https://github.com/advisories/GHSA-4mpw-cpwj-hxxj",
"summary": "Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in System.Net.Sockets. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nOn Windows, reusing a `SocketAsyncEventArgs` instance across IPv4 and IPv6 datagram sockets can retain an undersized cached native address buffer, allowing an unauthenticated out-of-bounds write during `ReceiveFromAsync`.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/466\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.1\n- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`\n\n- **Weakness:** CWE-787 (Out-of-bounds Write)\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-70197](https://www.cve.org/CVERecord?id=CVE-2026-70197)\n\n### Acknowledgements\n\n- Anonymous\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-4mpw-cpwj-hxxj",
"source_code_location": "https://github.com/dotnet/runtime",
"identifiers": [
{
"value": "GHSA-4mpw-cpwj-hxxj",
"type": "GHSA"
},
{
"value": "CVE-2026-70197",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/runtime/security/advisories/GHSA-4mpw-cpwj-hxxj",
"https://github.com/dotnet/announcements/issues/466",
"https://github.com/dotnet/runtime/issues/135702",
"https://github.com/advisories/GHSA-4mpw-cpwj-hxxj"
],
"published_at": "2026-10-13T20:34:32Z",
"updated_at": "2026-10-13T20:34:35Z",
"github_reviewed_at": "2026-10-13T20:34:32Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"score": 8.1
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-787",
"name": "Out-of-bounds Write"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"score": 8.1
}
},
{
"ghsa_id": "GHSA-3rxq-g8rj-r2cf",
"cve_id": "CVE-2026-69651",
"url": "https://api.github.com/advisories/GHSA-3rxq-g8rj-r2cf",
"html_url": "https://github.com/advisories/GHSA-3rxq-g8rj-r2cf",
"summary": "Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nSigned XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/449\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n- **Weakness:** CWE-407 (Inefficient Algorithmic Complexity)\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-69651](https://www.cve.org/CVERecord?id=CVE-2026-69651)\n\n### Acknowledgements\n\n- l8BL with ENKI WhiteHat (https://enki.co.kr/)\n- Leandro Batista\n- Kevin Schmidt\n- Dr.-Ing Ashar Javed (@soaj1664ashar)\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-3rxq-g8rj-r2cf",
"source_code_location": "https://github.com/dotnet/runtime",
"identifiers": [
{
"value": "GHSA-3rxq-g8rj-r2cf",
"type": "GHSA"
},
{
"value": "CVE-2026-69651",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/runtime/security/advisories/GHSA-3rxq-g8rj-r2cf",
"https://github.com/dotnet/announcements/issues/449",
"https://github.com/dotnet/runtime/issues/135698",
"https://github.com/advisories/GHSA-3rxq-g8rj-r2cf"
],
"published_at": "2026-10-13T20:32:47Z",
"updated_at": "2026-10-13T20:32:50Z",
"github_reviewed_at": "2026-10-13T20:32:47Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"score": 7.5
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"score": 7.5
}
},
{
"ghsa_id": "GHSA-g27p-qf6j-c96c",
"cve_id": "CVE-2026-102870",
"url": "https://api.github.com/advisories/GHSA-g27p-qf6j-c96c",
"html_url": "https://github.com/advisories/GHSA-g27p-qf6j-c96c",
"summary": "Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in the Blazor WebAssembly debugger included in `Microsoft.AspNetCore.Components.WebAssembly.Server`. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nThe Blazor WebAssembly debug proxy evaluates debugger expressions by generating and compiling C# source. Certain values originating in the application being debugged, including `ToString()` results, descriptions, and class names, are embedded in that generated source without consistent escaping. An attacker-controlled value can escape the generated string literal and execute code on a developer's machine when the developer evaluates an expression during debugging.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/445\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`\n- **Weakness:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.AspNetCore.Components.WebAssembly.Server](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Server) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.Components.WebAssembly.Server](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Server) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2.26478.115\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nYou are affected if you use a vulnerable version of `Microsoft.AspNetCore.Components.WebAssembly.Server` to debug a Blazor WebAssembly application and evaluate an expression involving attacker-controlled application data.\n\n### How do I fix the issue?\n\n1. Install the latest supported version of .NET.\n2. Update `Microsoft.AspNetCore.Components.WebAssembly.Server` to the patched version for the .NET release used by the application.\n\nOnce the updated package or runtime is installed, restart the debugger and development environment.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repositories are located at https://github.com/dotnet/runtime and https://github.com/dotnet/aspnetcore. The Announcements repository (https://github.com/dotnet/announcements) will contain this bulletin as an issue and will include a link to a discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-102870](https://www.cve.org/CVERecord?id=CVE-2026-102870)\n\n### Acknowledgements\n\nalittleston3\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/aspnetcore/security-advisories/GHSA-g27p-qf6j-c96c",
"source_code_location": "https://github.com/dotnet/aspnetcore",
"identifiers": [
{
"value": "GHSA-g27p-qf6j-c96c",
"type": "GHSA"
},
{
"value": "CVE-2026-102870",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-g27p-qf6j-c96c",
"https://github.com/dotnet/announcements/issues/445",
"https://github.com/dotnet/aspnetcore/discussions/69791",
"https://github.com/advisories/GHSA-g27p-qf6j-c96c"
],
"published_at": "2026-10-13T20:27:36Z",
"updated_at": "2026-10-13T20:27:38Z",
"github_reviewed_at": "2026-10-13T20:27:36Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.Components.WebAssembly.Server"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.Components.WebAssembly.Server"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2.26478.115",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-94",
"name": "Improper Control of Generation of Code ('Code Injection')"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"score": 8.8
}
},
{
"ghsa_id": "GHSA-7hqp-7c5m-4vq6",
"cve_id": "CVE-2026-96960",
"url": "https://api.github.com/advisories/GHSA-7hqp-7c5m-4vq6",
"html_url": "https://github.com/advisories/GHSA-7hqp-7c5m-4vq6",
"summary": "Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nSigned XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/490\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n- **Weakness:** CWE-405 (Asymmetric Resource Consumption (Amplification))\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 8.0.0, <= 8.0.4 | 8.0.5\n[System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 9.0.0, <= 9.0.20 | 9.0.21\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-96960](https://www.cve.org/CVERecord?id=CVE-2026-96960)\n\n### Acknowledgements\n\n- Coşkun Bağrıaçık\n- Dr.-Ing Ashar Javed (@soaj1664ashar)\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-7hqp-7c5m-4vq6",
"source_code_location": "https://github.com/dotnet/runtime",
"identifiers": [
{
"value": "GHSA-7hqp-7c5m-4vq6",
"type": "GHSA"
},
{
"value": "CVE-2026-96960",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/runtime/security/advisories/GHSA-7hqp-7c5m-4vq6",
"https://github.com/dotnet/announcements/issues/490",
"https://github.com/advisories/GHSA-7hqp-7c5m-4vq6"
],
"published_at": "2026-10-13T20:26:27Z",
"updated_at": "2026-10-13T20:26:29Z",
"github_reviewed_at": "2026-10-13T20:26:27Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "System.Security.Cryptography.Xml"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "System.Security.Cryptography.Xml"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "System.Security.Cryptography.Xml"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.4",
"first_patched_version": "8.0.5",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "System.Security.Cryptography.Xml"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"score": 7.5
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-405",
"name": "Asymmetric Resource Consumption (Amplification)"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"score": 7.5
}
},
{
"ghsa_id": "GHSA-87vj-4hqv-22p9",
"cve_id": "CVE-2026-96233",
"url": "https://api.github.com/advisories/GHSA-87vj-4hqv-22p9",
"html_url": "https://github.com/advisories/GHSA-87vj-4hqv-22p9",
"summary": "Microsoft Security Advisory CVE-2026-96233 - .NET and Visual Studio Denial of Service Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in System.Runtime. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nDateTime Hebrew-number parsing can read outside expected stack bounds and terminate the process.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/481\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n- **Weakness:** CWE-787 (Out-of-bounds Write)\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.31 | 8.0.32\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-96233](https://www.cve.org/CVERecord?id=CVE-2026-96233)\n\n### Acknowledgements\n\n- s3zer0\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "high",
"repository_advisory_url": "https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-87vj-4hqv-22p9",
"source_code_location": "https://github.com/dotnet/runtime",
"identifiers": [
{
"value": "GHSA-87vj-4hqv-22p9",
"type": "GHSA"
},
{
"value": "CVE-2026-96233",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/runtime/security/advisories/GHSA-87vj-4hqv-22p9",
"https://github.com/dotnet/announcements/issues/481",
"https://github.com/dotnet/runtime/issues/135708",
"https://github.com/advisories/GHSA-87vj-4hqv-22p9"
],
"published_at": "2026-10-13T20:25:37Z",
"updated_at": "2026-10-13T20:25:39Z",
"github_reviewed_at": "2026-10-13T20:25:37Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.linux-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.osx-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-arm64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x64"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.NETCore.App.Runtime.win-x86"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"score": 7.5
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-787",
"name": "Out-of-bounds Write"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"score": 7.5
}
},
{
"ghsa_id": "GHSA-86xp-94pg-8r6r",
"cve_id": null,
"url": "https://api.github.com/advisories/GHSA-86xp-94pg-8r6r",
"html_url": "https://github.com/advisories/GHSA-86xp-94pg-8r6r",
"summary": "Microsoft Security Advisory CVE-2026-92707 - ASP.NET Core Denial of Service Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.SignalR.Protocols.MessagePack; MessagePack; MessagePack.Annotations; MessagePackAnalyzer. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nSignalR's MessagePack protocol can consume excessive memory while deserializing deeply nested attacker-controlled arrays, resulting in unauthenticated remote denial of service.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/473\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Moderate\n- **Score:** 5.3\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`\n- **Weakness:** CWE-1325 (Improperly Controlled Sequential Memory Allocation)\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.AspNetCore.SignalR.Protocols.MessagePack](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.Protocols.MessagePack) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[Microsoft.AspNetCore.SignalR.Protocols.MessagePack](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.Protocols.MessagePack) | >= 11.0.0-preview.5, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.AspNetCore.SignalR.Protocols.MessagePack](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.Protocols.MessagePack) | >= 8.0.0, <= 8.0.31 | 8.0.32\n[Microsoft.AspNetCore.SignalR.Protocols.MessagePack](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.Protocols.MessagePack) | >= 9.0.0, <= 9.0.20 | 9.0.21\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-92707](https://www.cve.org/CVERecord?id=CVE-2026-92707)\n\n### Acknowledgements\n\nAnonymous\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "medium",
"repository_advisory_url": "https://api.github.com/repos/dotnet/aspnetcore/security-advisories/GHSA-86xp-94pg-8r6r",
"source_code_location": "https://github.com/dotnet/aspnetcore",
"identifiers": [
{
"value": "GHSA-86xp-94pg-8r6r",
"type": "GHSA"
}
],
"references": [
"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-86xp-94pg-8r6r",
"https://github.com/dotnet/announcements/issues/473",
"https://github.com/dotnet/aspnetcore/discussions/69801",
"https://github.com/advisories/GHSA-86xp-94pg-8r6r"
],
"published_at": "2026-10-13T20:11:58Z",
"updated_at": "2026-10-13T20:12:01Z",
"github_reviewed_at": "2026-10-13T20:11:58Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack"
},
"vulnerable_version_range": ">= 11.0.0-preview.5, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.31",
"first_patched_version": "8.0.32",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"score": 5.3
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-1325",
"name": "Improperly Controlled Sequential Memory Allocation"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"score": 5.3
}
},
{
"ghsa_id": "GHSA-2fmv-rv2c-59x7",
"cve_id": "CVE-2026-70162",
"url": "https://api.github.com/advisories/GHSA-2fmv-rv2c-59x7",
"html_url": "https://github.com/advisories/GHSA-2fmv-rv2c-59x7",
"summary": "Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability",
"description": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nOn Windows, `EnvelopedCms.Decode` can perform quadratic work while processing attacker-supplied CMS or PKCS#7 attributes, causing pre-authentication CPU exhaustion.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/454\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Moderate\n- **Score:** 5.9\n- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H`\n- **Weakness:** CWE-405 (Asymmetric Resource Consumption (Amplification))\n\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** All\n\n## Affected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 10.0.0, <= 10.0.12 | 10.0.13\n[System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2\n[System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 8.0.0, <= 8.0.1 | 8.0.2\n[System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 9.0.0, <= 9.0.20 | 9.0.21\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability.\n\n### How do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you've deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-70162](https://www.cve.org/CVERecord?id=CVE-2026-70162)\n\n### Acknowledgements\n\n- Dr.-Ing Ashar Javed (@soaj1664ashar)\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
"type": "reviewed",
"severity": "medium",
"repository_advisory_url": "https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-2fmv-rv2c-59x7",
"source_code_location": "https://github.com/dotnet/runtime",
"identifiers": [
{
"value": "GHSA-2fmv-rv2c-59x7",
"type": "GHSA"
},
{
"value": "CVE-2026-70162",
"type": "CVE"
}
],
"references": [
"https://github.com/dotnet/runtime/security/advisories/GHSA-2fmv-rv2c-59x7",
"https://github.com/dotnet/announcements/issues/454",
"https://github.com/dotnet/runtime/issues/135699",
"https://github.com/advisories/GHSA-2fmv-rv2c-59x7"
],
"published_at": "2026-10-13T20:07:20Z",
"updated_at": "2026-10-13T20:07:21Z",
"github_reviewed_at": "2026-10-13T20:07:20Z",
"nvd_published_at": null,
"withdrawn_at": null,
"vulnerabilities": [
{
"package": {
"ecosystem": "nuget",
"name": "System.Security.Cryptography.Pkcs"
},
"vulnerable_version_range": ">= 10.0.0, <= 10.0.12",
"first_patched_version": "10.0.13",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "System.Security.Cryptography.Pkcs"
},
"vulnerable_version_range": ">= 11.0.0-preview.1, <= 11.0.0-rc.1",
"first_patched_version": "11.0.0-rc.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "System.Security.Cryptography.Pkcs"
},
"vulnerable_version_range": ">= 8.0.0, <= 8.0.1",
"first_patched_version": "8.0.2",
"vulnerable_functions": [
]
},
{
"package": {
"ecosystem": "nuget",
"name": "System.Security.Cryptography.Pkcs"
},
"vulnerable_version_range": ">= 9.0.0, <= 9.0.20",
"first_patched_version": "9.0.21",
"vulnerable_functions": [
]
}
],
"cvss_severities": {
"cvss_v3": {
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"score": 5.9
},
"cvss_v4": {
"vector_string": null,
"score": 0.0
}
},
"cwes": [
{
"cwe_id": "CWE-405",
"name": "Asymmetric Resource Consumption (Amplification)"
}
],
"credits": [
],
"comments": 0,
"cvss": {
"vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"score": 5.9
}
}
]