Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-96229

Fixed upstream EPSS <1%CVSS 6.5

Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.

Published 2026-10-13 · CVE record · OSV

Products: Microsoft .NET 10.0 runtime, Microsoft .NET 11.0 runtime, Microsoft .NET 8.0 runtime, Microsoft .NET 9.0 runtime, Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10

Fixed upstream

EcosystemPackageFixed in
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-arm649.0.21
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-arm6410.0.13
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-arm6411.0.0-rc.2
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-arm648.0.32
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-x649.0.21
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-x6410.0.13
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-x6411.0.0-rc.2
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-x648.0.32
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-x869.0.21
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-x8610.0.13
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-x8611.0.0-rc.2
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-x868.0.32

Distro releases

ReleasePackageFixed in
Ubuntu 22.04 LTSdotnet7no fix