high7.0
CVE-2026-50526
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
Impact
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Microsoft.NET.Build.Containers | >= 10.0.0, <= 10.0.9 | 10.0.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | .Net | from 8.0.0 before 8.0.29 from 9.0.0 before 9.0.18 from 10.0.0 before 10.0.6 |
| Microsoft | Visual Studio 2022 | from 17.12.0 before 17.12.22 from 17.14.0 before 17.14.36 |
| Microsoft | Visual Studio 2026 | from 18.7.0 before 18.7.4 |
| Microsoft | .NET 10.0 Runtime | from 10.0.0 before 10.0.10 |
| Microsoft | .NET 8.0 Runtime | from 8.0.0 before 8.0.29 |
| Microsoft | .NET 9.0 Runtime | from 9.0.0 before 9.0.18 |
| Microsoft | Microsoft Visual Studio 2022 Version 17.12 | from 17.12.0 before 17.12.22 |
| Microsoft | Microsoft Visual Studio 2022 Version 17.14 | from 17.14.0 before 17.14.36 |
| Microsoft | Microsoft Visual Studio 2026 Version 18.7 | from 18.0 before 18.7.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-55jh-fwmh-39m4
- https://github.com/dotnet/sdk/security/advisories/GHSA-55jh-fwmh-39m4
- https://nvd.nist.gov/vuln/detail/CVE-2026-50526
- https://github.com/dotnet/announcements/issues/415
- https://github.com/dotnet/sdk/issues/55274
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50526