CVE-2018-8416

Tampering vulnerability in .NET Core

6.5 MediumFix available

CVE-2018-8416 is a medium vulnerability (CVSS 6.5) in Microsoft .net Core, published November 14, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.26%, the 94th percentile. Fixed in Microsoft.NETCore.App 2.1.7.

A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

7.26%Down 3.5 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.

Record: CVE-2018-8416
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.

Record: CVE-2018-8416
Updated: 2026-11-02

EUVDEUVD-2022-2505 No score

A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.

Record: EUVD-2022-2505
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5633-f33j-c6f7 6.5

Tampering vulnerability in .NET Core

A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.

Record: GHSA-5633-f33j-c6f7
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSV 6.5

A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.

Record: CVE-2018-8416
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVGHSA-5633-f33j-c6f7 6.5

Tampering vulnerability in .NET Core

A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.

Record: GHSA-5633-f33j-c6f7
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2018:3676 5.5

Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security update

Record: RHSA-2018:3676
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-8416 6.5

A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.

Record: UBUNTU-CVE-2018-8416
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`Microsoft.NETCore.App` NuGet	2.1.0 up to 2.1.7	2.1.7
`Microsoft.NETCore.App` NuGet	2.1.0 up to 2.1.7, plus listed versions 2.1.12.1.22.1.32.1.42.1.52.1.6	2.1.7
`rh-dotnet21-dotnet` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.500-5.el7	0:2.1.500-5.el7
`rh-dotnet21-dotnet-debuginfo` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.500-5.el7	0:2.1.500-5.el7
`rh-dotnet21-dotnet-host` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.6-5.el7	0:2.1.6-5.el7
`rh-dotnet21-dotnet-runtime-2.1` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.6-5.el7	0:2.1.6-5.el7
`rh-dotnet21-dotnet-sdk-2.1` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.500-5.el7	0:2.1.500-5.el7
`rh-dotnet21-dotnet-sdk-2.1.5xx` Red Hat:rhel_dotnet:2.1::el7	before 0:2.1.500-5.el7	0:2.1.500-5.el7
`mono` Ubuntu:14.04:LTS	All versions, plus listed versions 2.10.8.1-5ubuntu23.2.3+dfsg-53.2.3+dfsg-7ubuntu13.2.8+dfsg-4ubuntu13.2.8+dfsg-4ubuntu1.1	None known
`mono` Ubuntu:16.04:LTS	All versions, plus listed versions 3.2.8+dfsg-4ubuntu44.2.1.102+dfsg2-5ubuntu14.2.1.102+dfsg2-7ubuntu4	None known

Show 9 moreShow less

Affected packages
Package	Affected	Fixed
`mono-reference-assemblies` Ubuntu:16.04:LTS	All versions, plus listed versions 3.12.1+dfsg-1	None known
`mono` Ubuntu:18.04:LTS	All versions, plus listed versions 4.6.2.7+dfsg-1ubuntu1	None known
`mono-reference-assemblies` Ubuntu:18.04:LTS	All versions, plus listed versions 3.12.1+dfsg-2	None known
`mono` Ubuntu:20.04:LTS	All versions, plus listed versions 5.18.0.240+dfsg-36.8.0.105+dfsg-16.8.0.105+dfsg-2	None known
`mono` Ubuntu:22.04:LTS	All versions, plus listed versions 6.8.0.105+dfsg-3.2	None known
`mono` Ubuntu:24.04:LTS	All versions, plus listed versions 6.8.0.105+dfsg-3.46.8.0.105+dfsg-3.5ubuntu16.8.0.105+dfsg-3.6ubuntu16.8.0.105+dfsg-3.6ubuntu2	None known
`mono` Ubuntu:25.10	All versions, plus listed versions 6.12.0.199+dfsg-36.12.0.199+dfsg-6	None known
`mono` Ubuntu:26.10	All versions, plus listed versions 6.14.1+ds2-26.14.1+ds2-3	None known
`mono` Ubuntu:26.04:LTS	All versions, plus listed versions 6.12.0.199+dfsg-66.14.1+ds2-16.14.1+ds2-2	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 9 moreShow less