EUVD-2026-35675
GHSA-7q4v-2mr6-5gpx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionNVD
Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.
AnalysisAI
Local file tampering via symlink/junction following in Microsoft .NET runtimes 8.0, 9.0, and 10.0 allows a local unauthenticated attacker to redirect file operations to unintended targets, achieving high-integrity impact without requiring elevated privileges. The vulnerability stems from improper link resolution (CWE-59) before file access, enabling unauthorized modification of files the attacker would otherwise lack write access to. No public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity (AC:L) and absence of privilege requirements (PR:N) make exploitation straightforward for any actor with local access.
Technical ContextAI
CWE-59 (Improper Link Resolution Before File Access - 'Link Following') describes a class of vulnerabilities where an application resolves symbolic links, hard links, or OS junction points to a target path without adequately validating whether the resolved target is the intended one. In Windows and Linux environments, attackers can create symlinks or directory junctions that redirect .NET runtime file I/O to privileged or sensitive paths. The .NET runtime versions 8.0.0-8.0.27, 9.0.0-9.0.16, and 10.0.0-10.0.8 are confirmed affected per ENISA EUVD-2026-35675. The attack vector being local (AV:L) means the runtime's file handling code does not perform sufficient time-of-check to time-of-use (TOCTOU) or link target validation, allowing a race or pre-planted link to subvert expected access control decisions. The tag 'Authentication Bypass' from the intelligence source suggests the link-following behavior may circumvent OS-level access controls during .NET file operations.
RemediationAI
Upgrade to the vendor-released patched versions: .NET 8.0.28, .NET 9.0.17, or .NET 10.0.9, as applicable. The MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45491 provides official guidance and patch download links. For systems where immediate patching is not feasible, restrict local interactive and service account access to the minimum necessary - this directly limits the pool of potential attackers given the local attack vector requirement. Additionally, auditing and restricting write permissions to directories where .NET applications perform file I/O can reduce the opportunity for symlink planting. Note that compensating controls do not eliminate the vulnerability and carry operational trade-offs including potential breakage of legitimate application workflows that rely on symlinked paths.
Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
Denial of service in the Go standard library's net package (on Windows) allows remote attackers to crash applications by
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading
The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a
The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "pani
The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic:
Eval-based command injection in the Net::DNS module for Perl (versions through 1.55) lets a malicious or man-in-the-midd
.NET and Visual Studio Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is re
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this v
Weak PRNG in Net::NSCA::Client through 0.009002 for Perl. Patch available.
Metric injection in the Perl module Net::Statsite::Client through version 1.1.0 allows attackers controlling metric name
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today