Elevation of Privilege Vulnerability in .NET by Microsoft
CVE-2026-70190

7.3HIGH

Key Information:

Vendor

Microsoft
Status
.net 10.0 Runtime
.net 11.0 Runtime
.net 9.0 Runtime
Microsoft Visual Studio 2022 Version 17.14
Vendor
CVE Published:
13 October 2026

What is CVE-2026-70190?

An improper link resolution vulnerability in .NET can allow an authorized attacker to manipulate file access, leading to the potential for privilege escalation on affected systems. This vulnerability highlights the importance of secure coding practices to prevent unauthorized access to critical resources. Users and administrators are urged to apply relevant patches and updates to mitigate the risks associated with this issue.

Affected Version(s)

.NET 10.0 runtime 10.0.0 < 10.0.113

.NET 11.0 runtime 11.0.0 < 11.0.100-rc.2

.NET 9.0 runtime 9.0.0 < 9.0.319, 9.0.122

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.