Patch Forecast
Amber warning
Patch this week.

CVE-2026-96233 · GHSA-87vj-4hqv-22p9

Microsoft Security Advisory CVE-2026-96233 - .NET and Visual Studio Denial of Service Vulnerability

Risk score
71/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.8%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Affected
Microsoft.NETCore.App.Runtime.linux-arm (nuget) >= 10.0.0, <= 10.0.12; Microsoft.NETCore.App.Runtime.linux-arm64 (nuget) >= 10.0.0, <= 10.0.12; Microsoft.NETCore.App.Runtime.linux-musl-arm (nuget) >= 10.0.0, <= 10.0.12; Microsoft.NETCore.App.Runtime.linux-musl-arm64 (nuget) >= 10.0.0, <= 10.0.12
Fix
Upgrade Microsoft.NETCore.App.Runtime.linux-arm to 10.0.13; Microsoft.NETCore.App.Runtime.linux-arm64 to 10.0.13; Microsoft.NETCore.App.Runtime.linux-musl-arm to 10.0.13; Microsoft.NETCore.App.Runtime.linux-musl-arm64 to 10.0.13; Microsoft.NETCore.App.Runtime.linux-musl-x64 to 10.0.13; Microsoft.NE…
Exploitation
No known exploitation

Story map

Story map: Microsoft.NETCore.App.Runtime.linux-armTHE FLAWSTHE FIXCVE-2026-96233Microsoft Security AdvisoryCVE-2026-96233 - .NET andVisual Studio Denial of Service…CVSS 7.5 · EPSS 1%CVE-2026-69651Microsoft Security AdvisoryCVE-2026-69651 - .NET andVisual Studio Denial of Service…CVSS 7.5 · EPSS 1%CVE-2026-58280Microsoft Security AdvisoryCVE-2026-58280 - .NET andVisual Studio Denial of Service…CVSS 7.5 · EPSS 1%CVE-2026-96225Microsoft Security AdvisoryCVE-2026-96225 - .NET andVisual Studio Elevation of…CVSS 7.8 · EPSS 0%FixUpgradeMicrosoft.NETCore.App.Runtime.linux-arm to 9.0.21;Microsoft.NETCore.App.Runti…Who is exposedMicrosoft.NETCore.App.Runtime.linux-arm (nuget) >= 9.0.0, <=9.0.20;Microsoft.NETCore.App.Runtime.linux-arm64 (nuget) >=…AMBER · PATCH THIS WEEKMicrosoft.NETCore.App.Runtime.lin…Inefficient algorithmiccomplexity in .NET allows anunauthorized attacker to denyservice over a network.Where it standsNo known exploitationCONNECTS TOSame weaknessOut-of-bounds write (CWE-787)258 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Microsoft.NETCore.App.Runtime.linux-arm: Amber, patch this week. Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

The flaws

  • CVE-2026-96233: Microsoft Security Advisory CVE-2026-96233 - .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5 · EPSS 1%)
  • CVE-2026-69651: Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5 · EPSS 1%)
  • CVE-2026-58280: Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5 · EPSS 1%)
  • CVE-2026-96225: Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of Privilege Vulnerability (CVSS 7.8 · EPSS 0%)

The fix

Fix: Upgrade Microsoft.NETCore.App.Runtime.linux-arm to 9.0.21; Microsoft.NETCore.App.Runtime.linux-arm64 to 9.0.21; Microsoft.NETCore.App.Runtime.linux-musl-arm to 9.0.21; Microsoft.NETCore.App.Runtime.linux-musl-arm64 to 9.0.21; Microsoft.NETCore.App.Runtime.linux-musl-x64 to 9.0.21; Microsoft.NETCore…

Who is exposed: Microsoft.NETCore.App.Runtime.linux-arm (nuget) >= 9.0.0, <= 9.0.20; Microsoft.NETCore.App.Runtime.linux-arm64 (nuget) >= 9.0.0, <= 9.0.20; Microsoft.NETCore.App.Runtime.linux-musl-arm (nuget) >= 9.0.0, <= 9.0.20; Microsoft.NETCore.App.Runtime.linux-musl-arm64 (nuget) >= 9.0.0, <= 9.0.20

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Remotely exploitable without logging in
  • On your watchlist: .net, NuGet

Affected packages

PackageEcosystemVulnerableFixed in
Microsoft.NETCore.App.Runtime.linux-armnuget>= 10.0.0, <= 10.0.1210.0.13
Microsoft.NETCore.App.Runtime.linux-arm64nuget>= 10.0.0, <= 10.0.1210.0.13
Microsoft.NETCore.App.Runtime.linux-musl-armnuget>= 10.0.0, <= 10.0.1210.0.13
Microsoft.NETCore.App.Runtime.linux-musl-arm64nuget>= 10.0.0, <= 10.0.1210.0.13
Microsoft.NETCore.App.Runtime.linux-musl-x64nuget>= 10.0.0, <= 10.0.1210.0.13
Microsoft.NETCore.App.Runtime.linux-x64nuget>= 10.0.0, <= 10.0.1210.0.13
Microsoft.NETCore.App.Runtime.osx-arm64nuget>= 10.0.0, <= 10.0.1210.0.13
Microsoft.NETCore.App.Runtime.osx-x64nuget>= 10.0.0, <= 10.0.1210.0.13
Microsoft.NETCore.App.Runtime.win-armnuget>= 10.0.0, <= 10.0.1210.0.13
Microsoft.NETCore.App.Runtime.win-arm64nuget>= 10.0.0, <= 10.0.1210.0.13
Microsoft.NETCore.App.Runtime.win-x64nuget>= 10.0.0, <= 10.0.1210.0.13
Microsoft.NETCore.App.Runtime.win-x86nuget>= 10.0.0, <= 10.0.1210.0.13

References

Original description

Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Last activity 13 Oct 2026. Patch Forecast updates every hour.