CVE-2026-96225 · GHSA-w6wh-p4g7-mpj2

Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of Privilege Vulnerability

Risk score: 62/100
CVSS: 7.8 v3.1
Exploit chance (30 days): 0.3%
Published: 13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
Affected: Microsoft.NETCore.App.Runtime.linux-arm (nuget) >= 8.0.0, <= 8.0.31; Microsoft.NETCore.App.Runtime.linux-arm64 (nuget) >= 8.0.0, <= 8.0.31; Microsoft.NETCore.App.Runtime.linux-musl-arm (nuget) >= 8.0.0, <= 8.0.31; Microsoft.NETCore.App.Runtime.linux-musl-arm64 (nuget) >= 8.0.0, <= 8.0.31
Fix: Upgrade Microsoft.NETCore.App.Runtime.linux-arm to 8.0.32; Microsoft.NETCore.App.Runtime.linux-arm64 to 8.0.32; Microsoft.NETCore.App.Runtime.linux-musl-arm to 8.0.32; Microsoft.NETCore.App.Runtime.linux-musl-arm64 to 8.0.32; Microsoft.NETCore.App.Runtime.linux-musl-x64 to 8.0.32; Microsoft.NETCore…
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Microsoft.NETCore.App.Runtime.linux-arm: Amber, patch this week. Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

The flaws

CVE-2026-96225: Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of Privilege Vulnerability (CVSS 7.8 · EPSS 0%)
CVE-2026-69651: Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5 · EPSS 1%)
CVE-2026-58280: Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5 · EPSS 1%)
CVE-2026-96233: Microsoft Security Advisory CVE-2026-96233 - .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5 · EPSS 1%)

The fix

Fix: Upgrade Microsoft.NETCore.App.Runtime.linux-arm to 9.0.21; Microsoft.NETCore.App.Runtime.linux-arm64 to 9.0.21; Microsoft.NETCore.App.Runtime.linux-musl-arm to 9.0.21; Microsoft.NETCore.App.Runtime.linux-musl-arm64 to 9.0.21; Microsoft.NETCore.App.Runtime.linux-musl-x64 to 9.0.21; Microsoft.NETCore…

Who is exposed: Microsoft.NETCore.App.Runtime.linux-arm (nuget) >= 9.0.0, <= 9.0.20; Microsoft.NETCore.App.Runtime.linux-arm64 (nuget) >= 9.0.0, <= 9.0.20; Microsoft.NETCore.App.Runtime.linux-musl-arm (nuget) >= 9.0.0, <= 9.0.20; Microsoft.NETCore.App.Runtime.linux-musl-arm64 (nuget) >= 9.0.0, <= 9.0.20

Where it stands

No known exploitation

Connects to

Same weakness: CWE-59 (CWE-59). 78 other warnings in 30 days

Why it is Amber

CVSS 7.8 high
On your watchlist: .net, NuGet

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
Microsoft.NETCore.App.Runtime.linux-arm	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.NETCore.App.Runtime.linux-arm64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.NETCore.App.Runtime.linux-musl-arm	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.NETCore.App.Runtime.linux-musl-arm64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.NETCore.App.Runtime.linux-musl-x64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.NETCore.App.Runtime.linux-x64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.NETCore.App.Runtime.osx-arm64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.NETCore.App.Runtime.osx-x64	nuget	>= 8.0.0, <= 8.0.31	8.0.32
Microsoft.NETCore.App.Runtime.linux-arm	nuget	>= 10.0.0, <= 10.0.12	10.0.13
Microsoft.NETCore.App.Runtime.linux-arm64	nuget	>= 10.0.0, <= 10.0.12	10.0.13
Microsoft.NETCore.App.Runtime.linux-musl-arm	nuget	>= 10.0.0, <= 10.0.12	10.0.13
Microsoft.NETCore.App.Runtime.linux-musl-arm64	nuget	>= 10.0.0, <= 10.0.12	10.0.13

References

Original description

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

Last activity 13 Oct 2026. Patch Forecast updates every hour.