high7.8
CVE-2026-96231
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
Impact
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Microsoft.NETCore.App.Runtime.linux-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.NETCore.App.Runtime.linux-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.NETCore.App.Runtime.linux-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.NETCore.App.Runtime.osx-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| nuget | Microsoft.NETCore.App.Runtime.osx-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Microsoft Visual Studio 2022 Version 17.14 | from 17.14.0 before 17.14.42 |
| Microsoft | .NET 8.0 Runtime | from 8.0.0 before 8.0.32 |
| Microsoft | .NET 9.0 Runtime | from 9.0.0 before 9.0.21 |
| Microsoft | .NET 11.0 Runtime | from 11.0.0 before 11.0.0-rc.2 |
| Microsoft | .NET 10.0 Runtime | from 10.0.0 before 10.0.13 |
| Microsoft | Microsoft Visual Studio 2026 Version 18.10 | from 18.10.0 before 18.10.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-2j93-m82w-73j2
- https://github.com/dotnet/runtime/security/advisories/GHSA-2j93-m82w-73j2
- https://github.com/dotnet/announcements/issues/479
- https://github.com/dotnet/runtime/issues/135707
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96231