NetSight
IP …
high8.8

CVE-2026-83520

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

Impact

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

Affected packages

EcosystemPackageAffectedFixed in
nugetMicrosoft.WindowsDesktop.App.Runtime.win-arm64>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2
nugetMicrosoft.WindowsDesktop.App.Runtime.win-x64>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2
nugetMicrosoft.WindowsDesktop.App.Runtime.win-x86>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2

Affected products

VendorProductAffected versions
Microsoft.NET 10.0 Runtime
from 10.0.0 before 10.0.13
MicrosoftMicrosoft Visual Studio 2022 Version 17.14
from 17.14.0 before 17.14.42
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8
Version 4.8.0 <2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0
MicrosoftMicrosoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
Version 3.0.0.0 <2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0
MicrosoftMicrosoft .NET Framework 4.8.1
from 4.8.0.0 before 4.8.9363.0
Microsoft.NET 8.0 Runtime
from 8.0.0 before 8.0.32
MicrosoftMicrosoft Visual Studio 2026 Version 18.10
from 18.10.0 before 18.10.4
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8.1
Version 4.8.1 <2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0
Microsoft.NET 11.0 Runtime
from 11.0.0 before 11.0.0-rc.2
MicrosoftMicrosoft .NET Framework 4.8
from 4.8.0 before 4.8.4811.0
Microsoft.NET 9.0 Runtime
from 9.0.0 before 9.0.21
MicrosoftMicrosoft .NET Framework 3.5
Version 3.5.0 <2.0.50727.9188 AND 3.0.30729.9171

Weakness classification

CWE-502

References