CVE-2026-62886
Fixed upstream EPSS <1%CVSS 7.8
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
Products: Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.8, Microsoft .NET Framework 4.8.1, Microsoft Visual Studio 2026 version 18.8
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-arm64 | 10.0.11 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-arm64 | 9.0.19 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-arm64 | 8.0.30 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x64 | 10.0.11 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x64 | 9.0.19 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x64 | 8.0.30 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x86 | 10.0.11 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x86 | 9.0.19 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x86 | 8.0.30 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 22.04 LTS | dotnet7 | no fix |