CVE-2026-26127

highpriority · track · 1EPSS 0.021 · 82 %ileCHDEEUNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

2.13% (82nd) EPSS

CVSS 7.5 · high

Is it mine?

89 products

Check your exposure

Who says so?

9 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedaspnetcore-runtime-9.0-0:9.0.14-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-runtime-dbg-9.0-0:9.0.14-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-targeting-pack-9.0-0:9.0.14-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-apphost-pack-9.0-0:9.0.14-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-hostfxr-9.0-0:9.0.14-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-runtime-9.0-0:9.0.14-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-runtime-dbg-9.0-0:9.0.14-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-9.0-0:9.0.115-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-9.0-source-built-artifacts-0:9.0.115-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-aot-9.0-0:9.0.115-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-dbg-9.0-0:9.0.115-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-targeting-pack-9.0-0:9.0.14-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-templates-9.0-0:9.0.115-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednetstandard-targeting-pack-2.1-0:9.0.115-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-runtime-10.0-0:10.0.4-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-runtime-dbg-10.0-0:10.0.4-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-targeting-pack-10.0-0:10.0.4-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-apphost-pack-10.0-0:10.0.4-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-host-0:10.0.4-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-hostfxr-10.0-0:10.0.4-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-runtime-10.0-0:10.0.4-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-runtime-dbg-10.0-0:10.0.4-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-10.0-0:10.0.104-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-10.0-source-built-artifacts-0:10.0.104-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-aot-10.0-0:10.0.104-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-dbg-10.0-0:10.0.104-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-targeting-pack-10.0-0:10.0.4-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-templates-10.0-0:10.0.104-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-runtime-9.0-0:9.0.14-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-runtime-dbg-9.0-0:9.0.14-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-targeting-pack-9.0-0:9.0.14-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-apphost-pack-9.0-0:9.0.14-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-hostfxr-9.0-0:9.0.14-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-runtime-9.0-0:9.0.14-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-runtime-dbg-9.0-0:9.0.14-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-9.0-0:9.0.115-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-9.0-source-built-artifacts-0:9.0.115-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-aot-9.0-0:9.0.115-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-dbg-9.0-0:9.0.115-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-targeting-pack-9.0-0:9.0.14-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-templates-9.0-0:9.0.115-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednetstandard-targeting-pack-2.1-0:9.0.115-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-runtime-10.0-0:10.0.4-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-runtime-dbg-10.0-0:10.0.4-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-targeting-pack-10.0-0:10.0.4-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-apphost-pack-10.0-0:10.0.4-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-host-0:10.0.4-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-hostfxr-10.0-0:10.0.4-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-runtime-10.0-0:10.0.4-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-runtime-dbg-10.0-0:10.0.4-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-10.0-0:10.0.104-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-10.0-source-built-artifacts-0:10.0.104-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-aot-10.0-0:10.0.104-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-dbg-10.0-0:10.0.104-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-targeting-pack-10.0-0:10.0.4-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-templates-10.0-0:10.0.104-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-runtime-9.0-0:9.0.14-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-runtime-dbg-9.0-0:9.0.14-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-targeting-pack-9.0-0:9.0.14-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-apphost-pack-9.0-0:9.0.14-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-hostfxr-9.0-0:9.0.14-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-runtime-9.0-0:9.0.14-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-runtime-dbg-9.0-0:9.0.14-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-9.0-0:9.0.115-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-9.0-source-built-artifacts-0:9.0.115-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-aot-9.0-0:9.0.115-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-dbg-9.0-0:9.0.115-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-targeting-pack-9.0-0:9.0.14-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-templates-9.0-0:9.0.115-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednetstandard-targeting-pack-2.1-0:9.0.115-1.el9_7.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-runtime-10.0-0:10.0.4-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-runtime-dbg-10.0-0:10.0.4-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedaspnetcore-targeting-pack-10.0-0:10.0.4-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-0:10.0.104-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-apphost-pack-10.0-0:10.0.4-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-host-0:10.0.4-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-hostfxr-10.0-0:10.0.4-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-runtime-10.0-0:10.0.4-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-runtime-dbg-10.0-0:10.0.4-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-10.0-0:10.0.104-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-10.0-source-built-artifacts-0:10.0.104-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-aot-10.0-0:10.0.104-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-sdk-dbg-10.0-0:10.0.104-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-targeting-pack-10.0-0:10.0.4-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixeddotnet-templates-10.0-0:10.0.104-1.el8_10.x86_64 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
FixedLabX Standardmettler_toledo_psirt
Update to LabX Standard v21.4.23
Fixed.NET 10.0 installed on Linuxmsrc_csaf
10.0.4:Security Update:https://support.microsoft.com/help/5081276
https://support.microsoft.com/help/5081276
Fixed.NET 10.0 installed on Mac OSmsrc_csaf
10.0.4:Security Update:https://support.microsoft.com/help/5081276
https://support.microsoft.com/help/5081276
Fixed.NET 10.0 installed on Windowsmsrc_csaf
10.0.4:Security Update:https://support.microsoft.com/help/5081276
https://support.microsoft.com/help/5081276
Fixed.NET 9.0 installed on Linuxmsrc_csaf
9.0.14:Security Update:https://support.microsoft.com/help/5081278
https://support.microsoft.com/help/5081278
Fixed.NET 9.0 installed on Mac OSmsrc_csaf
9.0.14:Security Update:https://support.microsoft.com/help/5081278
https://support.microsoft.com/help/5081278
Fixed.NET 9.0 installed on Windowsmsrc_csaf
9.0.14:Security Update:https://support.microsoft.com/help/5081278
https://support.microsoft.com/help/5081278
FixedMicrosoft.Bcl.Memory 10.0msrc_csaf
10.0.4:Security Update
FixedMicrosoft.Bcl.Memory 9.0msrc_csaf
9.0.14:Security Update

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:Csecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · secure@microsoft.com USexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Mettler-Toledo PSIRT

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:Csecondary · NCSC-NL NL

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:Csecondary · Microsoft Security Response Center US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-125USCWE-125USCWE-125USCWE-125USCWE-125USCWE-125US

affected products (89)

Products and version ranges known to be affected.

Microsoft .NET 10.0all versionscert_bundDEcpe:/a:microsoft:.net:10.0
Microsoft .NET 9.0all versionscert_bundDEcpe:/a:microsoft:.net:9.0
Microsoft ASP.NET Core 10.0all versionscert_bundDEcpe:/a:microsoft:asp.net:core_10.0
Microsoft ASP.NET Core 8.0all versionscert_bundDEcpe:/a:microsoft:asp.net:core_8.0
Microsoft ASP.NET Core 9.0all versionscert_bundDEcpe:/a:microsoft:asp.net:core_9.0
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Microsoft .NET 10.010.0.0 → 10.0.4enisa_euvdEU
Microsoft .NET 9.09.0.0 → 9.0.14enisa_euvdEU
Microsoft Microsoft.Bcl.Memory10.0.0 → 10.0.4enisa_euvdEU
Microsoft Microsoft.Bcl.Memory9.0.0 → 9.0.14enisa_euvdEU
Microsoft Corp .NET10.0 → 10.0.4fstec_bduRU
Microsoft Corp .NET9.0 → 9.0.14fstec_bduRU
Microsoft Corp Microsoft.Bcl.Memory≤ 10.0.4fstec_bduRU
Microsoft Corp Microsoft.Bcl.Memory≤ 9.0.14fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 8.0fstec_bduRU
LabX Standardall versionsmettler_toledo_psirtCHcpe:2.3:a:mettler_toledo:labx_standard:21.3.22:*:*:*:*:*:*:*

showing 20 of 89

advisories (13)

Vendor and ecosystem advisories describing this.

NCSC-2026-0085Kwetsbaarheden verholpen in Microsoft Developer toolsNL2026-03-10csaf · ncsc_nlNL
Microsoft heeft kwetsbaarheden verholpen in .NET en PowerShell.
RHSA-2026:4443security update for dotnet9.02026-03-12csaf · suse_csafDE
security update for dotnet9.0
RHSA-2026:4445security update for dotnet10.02026-03-12csaf · suse_csafDE
security update for dotnet10.0
RHSA-2026:4450security update for dotnet9.02026-03-12csaf · suse_csafDE
security update for dotnet9.0
RHSA-2026:4453security update for dotnet10.02026-03-12csaf · suse_csafDE
security update for dotnet10.0
RHSA-2026:4456security update for dotnet9.02026-03-12csaf · suse_csafDE
security update for dotnet9.0
RHSA-2026:4458security update for dotnet10.02026-03-12csaf · suse_csafDE
security update for dotnet10.0
VDE-2026-064METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.32026-06-09csaf · mettler_toledo_psirtCH
Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be available in the upcoming releases. Notice: LabX Standard was formerly known as LabX Cloud Local.
WID-SEC-W-2026-0657Microsoft ASP.NET und .NET: Mehrere SchwachstellenDeutsch2026-03-10csaf · cert_bundDE
Ein lokaler. oder ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft ASP.NET und Microsoft .NET ausnutzen, um Administratorrechte zu erlangen oder um einen Denial-of-Service-Zustand zu verursachen.
msrc_CVE-2026-26127.NET Denial of Service Vulnerability2026-03-10csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
GHSA-73j8-2gch-69rq.NET Denial of Service Vulnerability2026-03-11ghsa · osvUS
# Microsoft Security Advisory CVE-2026-26127 – .NET Denial of Service Vulnerability ## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0 and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET and Microsoft.Bcl.Memory due to an out-of-bounds read when decoding malformed Base64Url input. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/384 ## CVSS Details - **Version:** 3.1 - **Score:** 7.5 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` - **Severity:** High - **Weakness:** CWE-129 (Improper Validation of Array Index); CWE-125 (Out-of-bounds Read) ## Affected Platforms - **Platforms:** All - **Architectures:** All ## Affected Products ### <a name=".NET 9"></a>.NET 9 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.NetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm) | >= 9.0.0, <= 9.0.13 | 9.0.14 [Microsoft.NetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm64) | >= 9.0.0, <= 9.0.13 | 9.0.14 [Microsoft.NetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-musl-arm) | >= 9.0.0, <= 9.0.13 | 9.0.14 [Microsoft.NetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0, <= 9.0.13 | 9.0.14 [Microsoft.NetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-musl-x64) | >= 9.0.0, <= 9.0.13 | 9.0.14 [Microsoft.NetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-x64) | >= 9.0.0, <= 9.0.13 | 9.0.14 [Microsoft.NetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.osx-arm64) | >= 9.0.0, <= 9.0.13 | 9.0.14 [Microsoft.NetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.osx-x64) | >= 9.0.0, <= 9.0.13 | 9.0.14 [Microsoft.NetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.win-arm) | >= 9.0.0, <= 9.0.13 | 9.0.14 [Microsoft.NetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.13 | 9.0.14 [Microsoft.NetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.13 | 9.0.14 [Microsoft.NetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.13 | 9.0.14 ### <a name=".NET 10"></a>.NET 10 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.NetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm) | >= 10.0.0, <= 10.0.3 | 10.0.4 [Microsoft.NetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm64) | >= 10.0.0, <= 10.0.3 | 10.0.4 [Microsoft.NetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-musl-arm) | >= 10.0.0, <= 10.0.3 | 10.0.4 [Microsoft.NetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-musl-arm64) | >= 10.0.0, <= 10.0.3 | 10.0.4 [Microsoft.NetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-musl-x64) | >= 10.0.0, <= 10.0.3 | 10.0.4 [Microsoft.NetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-x64) | >= 10.0.0, <= 10.0.3 | 10.0.4 [Microsoft.NetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.osx-arm64) | >= 10.0.0, <= 10.0.3 | 10.0.4 [Microsoft.NetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.osx-x64) | >= 10.0.0, <= 10.0.3 | 10.0.4 [Microsoft.NetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.win-arm) | >= 10.0.0, <= 10.0.3 | 10.0.4 [Microsoft.NetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.3 | 10.0.4 [Microsoft.NetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.3 | 10.0.4 [Microsoft.NetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.3 | 10.0.4 ### <a name="Microsoft.Bcl.Memory 9.0.14"></a>Microsoft.Bcl.Memory 9.0.14 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.Bcl.Memory](https://www.nuget.org/packages/Microsoft.Bcl.Memory) | >= 9.0.0, <= 9.0.13 | 9.0.14 ### <a name="Microsoft.Bcl.Memory 10.0.4"></a>Microsoft.Bcl.Memory 10.0.4 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.Bcl.Memory](https://www.nuget.org/packages/Microsoft.Bcl.Memory) | >= 10.0.0, <= 10.0.3 | 10.0.4 ### <a name="how-fix"></a>How to fix the issue To update the Microsoft.Bcl.Memory NuGet package, apply one of the following methods: NuGet Package Manager UI in Visual Studio: - Open the project in Visual Studio. - Right-click on the project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages". - In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from the configured package sources. - Select the package(s) to update. A specific version can be chosen from the dropdown, or the latest available version can be selected. - Click the "Update" button. Using the NuGet Package Manager Console in Visual Studio: - Open the project in Visual Studio. - Navigate to "Tools > NuGet Package Manager > Package Manager Console". - To update a specific package to its latest version, run the following Update-Package command: ``` Update-Package -Id Microsoft.Bcl.Memory ``` Using the .NET CLI (Command Line Interface): - Open a terminal or command prompt in the project's directory. - To update a specific package to its latest version, run the following command: ``` dotnet package update Microsoft.Bcl.Memory ``` Once the NuGet package reference has been updated, the application must be recompiled and redeployed. Additionally, it is recommended to update the runtime and/or SDKs, but unless the application targets .NET 9 or higher, updating the runtime and/or SDK is not a required step to patch this vulnerability. ## Other Information ### Reporting Security Issues If a potential security issue has been found in a supported version of .NET, it should be reported to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue). Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty. ### Support Questions about this issue can be asked on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. Questions can be asked in the linked discussion issue. ### Disclaimer The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. ### External Links [CVE-2026-26127](https://www.cve.org/CVERecord?id=CVE-2026-26127) ### Revisions V1.0 (March 10, 2026): Advisory published.
BIT-dotnet-2026-26127.NET Denial of Service Vulnerability2026-04-06vendor · osvUS
Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.
BIT-dotnet-sdk-2026-26127.NET Denial of Service Vulnerability2026-04-06vendor · osvUS
Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.

also known as (8)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund mettler_toledo_psirt ncsc_nl suse_csaf msrc_csaf NVD CVE.org MITRE

published 2026-03-10modified 2026-06-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan