7.5Hoch

CVE-2026-114157ASP.NET Core Security Feature Bypass Vulnerability

Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Windows; Microsoft .NET 8.0 installed on Windows; Microsoft .NET 9.0 installed on Windows Veröffentlicht: (gestern)

Beschreibung

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Schwachstellentyp (CWE): CWE-362

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Microsoft Microsoft Visual Studio 2022 version 17.14 17.14.0 – < 17.14.45
Microsoft Microsoft Visual Studio 2026 version 18.11 18.11.0 – < 18.11.4
Microsoft Microsoft Visual Studio 2026 version 18.12 18.12.0 – < 18.12.0
Microsoft .NET 10.0 installed on Windows 10.0.0 – < 10.0.15
Microsoft .NET 11.0 installed on Windows 11.0.0-preview.1 – < 11.0.0
Microsoft .NET 8.0 installed on Windows 8.0.0 – < 8.0.34
Microsoft .NET 9.0 installed on Windows 9.0.0 – < 9.0.23
microsoft visual studio 2022 17.14.0 – < 17.14.45

Referenzen und Patches