medium6.2
CVE-2026-45491
Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.
Impact
Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Microsoft.NETCore.App.Runtime.linux-x64 | >= 8.0.0, <= 8.0.27 | 8.0.28 |
| nuget | Microsoft.NETCore.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.27 | 8.0.28 |
| nuget | Microsoft.NETCore.App.Runtime.osx-arm64 | >= 8.0.0, <= 8.0.27 | 8.0.28 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | .Net | from 8.0.0 before 8.0.28 from 9.0.0 before 9.0.17 from 10.0.0 before 10.0.9 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-7q4v-2mr6-5gpx
- https://github.com/dotnet/runtime/security/advisories/GHSA-7q4v-2mr6-5gpx
- https://nvd.nist.gov/vuln/detail/CVE-2026-45491
- https://github.com/dotnet/announcements/issues/404
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45491