high7.8
CVE-2026-50650
Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.
Impact
Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| nuget | Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
| nuget | Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.9 | 10.0.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | .Net Framework | Versions 4.8, 4.6.2, 4.7, 4.7.1, 4.7.2, 3.5 |
| Microsoft | .Net | from 8.0.0 before 8.0.29 from 9.0.0 before 9.0.18 |
| Microsoft | .NET 8.0 Runtime | from 8.0.0 before 8.0.29 |
| Microsoft | .NET 9.0 Runtime | from 9.0.0 before 9.0.18 |
| Microsoft | Microsoft .NET Framework 3.5 | from 3.5.0 before 2.0.50727.8983 & 3.0.30729.8978 Version 3.5.0 <2.0.50727.8983 & 3.0.30729.8978 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.7.2 | from 4.7.0 before 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0 Version 4.7.0 <2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8 | from 4.8.0 before 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 Version 4.8.0 <2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 | from 4.8.1 before 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 Version 4.8.1 <2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 |
| Microsoft | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 | from 4.7.0 before 4.7.4143.0 |
| Microsoft | Microsoft .NET Framework 4.8 | from 4.8.0 before 4.8.4803.0 |
| Microsoft | Microsoft Visual Studio 2022 Version 17.12 | from 17.12.0 before 17.12.22 |
| Microsoft | Microsoft Visual Studio 2022 Version 17.14 | from 17.14.0 before 17.14.36 |
| Microsoft | Microsoft Visual Studio 2026 Version 18.7 | from 18.0 before 18.7.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-2969-4q4w-w5h3
- https://github.com/dotnet/wpf/security/advisories/GHSA-2969-4q4w-w5h3
- https://nvd.nist.gov/vuln/detail/CVE-2026-50650
- https://github.com/dotnet/announcements/issues/421
- https://github.com/dotnet/wpf/issues/11784
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50650