high7.8
CVE-2026-50649
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.
Impact
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | .Net Framework | Versions 4.8.1, 4.8, 4.6.2, 4.7, 4.7.1, 4.7.2 |
| Microsoft | .Net | from 8.0.0 before 8.0.29 from 9.0.0 before 9.0.18 |
| Microsoft | Visual Studio 2026 | from 18.7.0 before 18.7.4 |
| Microsoft | .NET 8.0 Runtime | from 8.0.0 before 8.0.29 |
| Microsoft | .NET 9.0 Runtime | from 9.0.0 before 9.0.18 |
| Microsoft | Microsoft .NET Framework 3.5 | from 3.5.0 before 2.0.50727.9182 & 3.0.30729.9168 Version 3.5.0 <2.0.50727.9182 & 3.0.30729.9168 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.7.2 | from 4.7.0 before 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0 Version 4.7.0 <2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8 | from 4.8.0 before 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 Version 4.8.0 <2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 | from 4.8.1 before 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 Version 4.8.1 <2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 |
| Microsoft | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 | from 4.7.0 before 4.7.4143.0 |
| Microsoft | Microsoft .NET Framework 4.8 | from 4.8.0 before 4.8.4803.0 |
| Microsoft | Microsoft .NET Framework 4.8.1 | from 4.8.0.0 before 4.8.9340.0 |
| Microsoft | Microsoft Visual Studio 2026 Version 18.7 | from 18.0 before 18.7.4 |