EUVD-2026-44394
GHSA-55jh-fwmh-39m4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Local low-priv attacker winning a symlink TOCTOU race (AV:L/AC:H/PR:L); description emphasizes tampering so I:H/A:H, with only limited confidentiality (C:L) since impact is redirected file writes.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
AnalysisAI
Local tampering via symbolic-link following in Microsoft .NET (versions 8.0, 9.0, and 10.0) and the bundled toolchain in Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7) allows an authorized local attacker to redirect a privileged file operation to an unintended target, corrupting or replacing files outside their normal permissions. Microsoft (the reporter) has released a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. The high CVSS 3.1 base score of 7.0 is tempered by high attack complexity and the requirement for existing low-level local access.
Technical ContextAI
The root cause is CWE-59 (Improper Link Resolution Before File Access, 'link following'). A process - here a .NET runtime/SDK component or a Visual Studio build/tooling operation - resolves a filesystem path without first verifying that an intermediate directory or the final path element is a genuine file rather than a symbolic link, hard link, or junction. An attacker who can place or swap such a link between the time the path is checked and the time it is used (a classic TOCTOU race, consistent with the AC:H rating) causes the trusted process to read from or write to an attacker-chosen location. The affected CPEs pinpoint the Microsoft .NET 8.0/9.0/10.0 runtimes plus the Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7) packages that ship the vulnerable .NET components, so both server/runtime hosts and developer workstations are in scope.
RemediationAI
Patch available per vendor advisory: apply the Microsoft update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50526, which covers the affected .NET 8.0/9.0/10.0 runtimes and SDKs and the Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7) packages - the exact fixed version numbers are enumerated in that advisory and should be pulled from there rather than assumed. Update .NET via the OS/servicing channel or a fresh SDK/runtime installer, and update Visual Studio through the Visual Studio Installer to the latest servicing build of each listed version. Until patched, reduce exposure by limiting interactive and local logon rights on servers and build agents so untrusted low-privileged users cannot stage symlinks, tightening ACLs on directories where .NET/build processes create or write files, and, on Windows, restricting the ability to create symbolic links (the SeCreateSymbolicLinkPrivilege, granted only to administrators by default) - note these controls constrain legitimate multi-user and CI scenarios and are stopgaps, not a substitute for the update.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today