high7.8
CVE-2026-62886
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
Impact
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.10 | 10.0.11 |
| nuget | Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.10 | 10.0.11 |
| nuget | Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.10 | 10.0.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Visual Studio 2022 | from 17.14.0 before 17.14.38 |
| Microsoft | Visual Studio 2026 | from 18.8.0 before 18.8.3 |
| Microsoft | .Net | from 8.0.0 before 8.0.30 from 9.0.0 before 9.0.19 from 10.0.0 before 10.0.11 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-jqhp-238x-qhgf
- https://github.com/dotnet/wpf/security/advisories/GHSA-jqhp-238x-qhgf
- https://nvd.nist.gov/vuln/detail/CVE-2026-62886
- https://github.com/dotnet/announcements/issues/430
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62886