CVE-2026-35433
Fixed upstream EPSS <1%CVSS 7.3
Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
Products: Microsoft .NET 10.0, Microsoft .NET 8.0, Microsoft .NET 9.0, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 4.8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-arm64 | 8.0.27 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-arm64 | 9.0.16 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-arm64 | 10.0.8 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x64 | 8.0.27 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x64 | 9.0.16 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x64 | 10.0.8 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x86 | 8.0.27 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x86 | 9.0.16 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x86 | 10.0.8 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 22.04 LTS | dotnet7 | no fix |