MicrosoftCVE-2026-57108

Microsoft .NET: type confusion

CVE-2026-57108 · Published Jul 14, 2026 · updated Oct 28, 2026

High7.5

Fix: upgrade to 10.0.10 or later (3 fixed versions below)

Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.

Affected versions

Package	Affected	Fixed in
.NET 10.0 runtime Product	>= 10.0.0, < 10.0.10	10.0.10
.NET 8.0 runtime Product	>= 8.0.0, < 8.0.29	8.0.29
.NET 9.0 runtime Product	>= 9.0.0, < 9.0.18	9.0.18

Changes since it was listed

Fixed inNov 3Fixed in: .NET 10.0 10.0.10, .NET 8.0 8.0.29, .NET 9.0 9.0.18 to .NET 10.0 runtime 10.0.10, .NET 8.0 runtime 8.0.29, .NET 9.0 runtime 9.0.18

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-843

More Microsoft advisories

All Microsoft

HighJul 14

Secret exfiltration vulnerabilityCVE-2026-47282fixed in 1.128.1 HighJul 14

Workspace Trust Security Feature Bypass VulnerabilityCVE-2026-57101fixed in 1.128.1 HighJul 14

Remote Code Execution VulnerabilityCVE-2026-57102fixed in 1.128.1 High 7.8Jul 14

Microsoft .NET 8.0 runtime: unsafe deserializationCVE-2026-50649fixed in 8.0.29 +9 High 7.8Jul 14

Microsoft .NET 8.0 runtime: code injectionCVE-2026-50650fixed in 8.0.29 +10 High 7.5Jul 14

Microsoft .NET 10.0 runtime: resource exhaustionCVE-2026-50651fixed in 10.0.10 +5