CVE-2026-26131
Fixed in a distro release EPSS <1%CVSS 7.8
Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
Products: Microsoft .NET 10.0
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| NuGet | Microsoft.NetCore.App.Runtime.linux-arm | 10.0.4 |
| NuGet | Microsoft.NetCore.App.Runtime.linux-arm64 | 10.0.4 |
| NuGet | Microsoft.NetCore.App.Runtime.linux-musl-arm | 10.0.4 |
| NuGet | Microsoft.NetCore.App.Runtime.linux-musl-arm64 | 10.0.4 |
| NuGet | Microsoft.NetCore.App.Runtime.linux-musl-x64 | 10.0.4 |
| NuGet | Microsoft.NetCore.App.Runtime.linux-x64 | 10.0.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | dotnet-bootstrap-10 | no fix |
| Red Hat hummingbird 1 | dotnet10.0 | 0:10.0.106-1.hum1 |
| Ubuntu 22.04 LTS | dotnet7 | no fix |
| Wolfi | dotnet-bootstrap-10 | no fix |