high7.8
CVE-2026-50646
Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.
Impact
Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| nuget | Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| nuget | Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | .Net Framework | Versions 4.8, 4.6.2, 4.7, 4.7.1, 4.7.2, 3.5 |
| Microsoft | .Net | from 8.0.0 before 8.0.29 from 9.0.0 before 9.0.18 |
| Microsoft | Visual Studio 2022 | from 17.12.0 before 17.12.22 from 17.14.0 before 17.14.36 |
| Microsoft | Visual Studio 2026 | from 18.7.0 before 18.7.4 |
| Microsoft | .NET 8.0 Runtime | from 8.0.0 before 8.0.29 |
| Microsoft | .NET 9.0 Runtime | from 9.0.0 before 9.0.18 |
| Microsoft | Microsoft .NET Framework 3.5 | from 3.5.0 before 2.0.50727.8983 & 3.0.30729.8978 Version 3.5.0 <2.0.50727.8983 & 3.0.30729.8978 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.7.2 | from 4.7.0 before 2.0.50727.8983 & 3.0.30729.8978 & 4.7.4143.0 Version 4.7.0 <2.0.50727.8983 & 3.0.30729.8978 & 4.7.4143.0 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8 | from 4.8.0 before 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 Version 4.8.0 <2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 | from 4.8.1 before 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 Version 4.8.1 <2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 |
| Microsoft | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 | from 4.7.0 before 4.7.4143.0 |
| Microsoft | Microsoft .NET Framework 4.8 | from 4.8.0 before 4.8.4803.0 |
| Microsoft | Microsoft Visual Studio 2022 Version 17.12 | from 17.12.0 before 17.12.22 |
| Microsoft | Microsoft Visual Studio 2022 Version 17.14 | from 17.14.0 before 17.14.36 |
| Microsoft | Microsoft Visual Studio 2026 Version 18.7 | from 18.0 before 18.7.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-gh2h-rhph-h37g
- https://github.com/dotnet/wpf/security/advisories/GHSA-gh2h-rhph-h37g
- https://nvd.nist.gov/vuln/detail/CVE-2026-50646
- https://github.com/dotnet/announcements/issues/418
- https://github.com/dotnet/wpf/issues/11782
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50646