AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MicrosoftCVE-2026-50526

Microsoft .NET 10.0 runtime: tampering

Microsoft

CVE-2026-50526 · Published Jul 14, 2026 · updated Oct 28, 2026

High7.0
Fix: upgrade to 10.0.10 or later (6 fixed versions below)
Microsoft advisory

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

Affected versions

PackageAffectedFixed in
.NET 10.0 runtime
Product
>= 10.0.0, < 10.0.1010.0.10
.NET 8.0 runtime
Product
>= 8.0.0, < 8.0.298.0.29
.NET 9.0 runtime
Product
>= 9.0.0, < 9.0.189.0.18
Microsoft Visual Studio 2022 version 17.12
Product
>= 17.12.0, < 17.12.2217.12.22
Microsoft Visual Studio 2022 version 17.14
Product
>= 17.14.0, < 17.14.3617.14.36
Microsoft Visual Studio 2026 version 18.7
Product
>= 18.0, < 18.7.418.7.4

Changes since it was listed

Fixed inNov 3Fixed in: .NET 10.0 10.0.10, .NET 8.0 8.0.29, .NET 9.0 9.0.18 to .NET 10.0 runtime 10.0.10, .NET 8.0 runtime 8.0.29, .NET 9.0 runtime 9.0.18
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-59, CWE-345

More Microsoft advisories

All Microsoft
HighJul 14Secret exfiltration vulnerabilityCVE-2026-47282fixed in 1.128.1HighJul 14Workspace Trust Security Feature Bypass VulnerabilityCVE-2026-57101fixed in 1.128.1HighJul 14Remote Code Execution VulnerabilityCVE-2026-57102fixed in 1.128.1High 7.8Jul 14Microsoft .NET 8.0 runtime: unsafe deserializationCVE-2026-50649fixed in 8.0.29 +9High 7.8Jul 14Microsoft .NET 8.0 runtime: code injectionCVE-2026-50650fixed in 8.0.29 +10High 7.5Jul 14Microsoft .NET 10.0 runtime: resource exhaustionCVE-2026-50651fixed in 10.0.10 +5