CVE-2026-114148

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.123 Runtime version: 9.0.22

Security Fix(es):

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 9.0 to SDK 9.0.123 and Runtime 9.0.22 (JIRA:Rocky Linux-291723)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.133 Runtime version: 8.0.33

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 [rhel-10.2.z] (JIRA:Rocky Linux-291718)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.123 Runtime version: 9.0.22

Security Fix(es):

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 9.0 to SDK 9.0.123 and Runtime 9.0.22 [rhel-9.8.z] (JIRA:Rocky Linux-291727)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.123 Runtime version: 9.0.22

Security Fix(es):

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 9.0 to SDK 9.0.123 and Runtime 9.0.22 [rhel-10.2.z] (JIRA:Rocky Linux-291728)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 10.0.114 Runtime version: 10.0.14

Security Fix(es):

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 10.0 to SDK 10.0.114 and Runtime 10.0.14 (JIRA:Rocky Linux-291741)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 10.0.114 Runtime version: 10.0.14

Security Fix(es):

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 10.0 to SDK 10.0.114 and Runtime 10.0.14 [rhel-9.8.z] (JIRA:Rocky Linux-291744)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 10.0.114 Runtime version: 10.0.14

Security Fix(es):

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 10.0 to SDK 10.0.114 and Runtime 10.0.14 [rhel-10.2.z] (JIRA:Rocky Linux-291745)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.133 Runtime version: 8.0.33

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 [rhel-9.8.z] (JIRA:Rocky Linux-291717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 11.0.100rc.3.26522.148 Runtime version: 11.0.0rc.3.26522.148

Security Fix(es):

• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 11 to RC 1 (JIRA:Rocky Linux-260220)

• Update .NET 11 to RC 2 (JIRA:Rocky Linux-276919)

• Update .NET 11 to RC 3 (JIRA:Rocky Linux-292372)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.133
Runtime version: 8.0.33

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 (JIRA:RHEL-291714)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.123
Runtime version: 9.0.22

Security Fix(es):

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 9.0 to SDK 9.0.123 and Runtime 9.0.22 (JIRA:RHEL-291723)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.133
Runtime version: 8.0.33

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 [rhel-10.2.z] (JIRA:RHEL-291718)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.123
Runtime version: 9.0.22

Security Fix(es):

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 9.0 to SDK 9.0.123 and Runtime 9.0.22 [rhel-9.8.z] (JIRA:RHEL-291727)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 9.0.123
Runtime version: 9.0.22

Security Fix(es):

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 9.0 to SDK 9.0.123 and Runtime 9.0.22 [rhel-10.2.z] (JIRA:RHEL-291728)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 10.0.114
Runtime version: 10.0.14

Security Fix(es):

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 10.0 to SDK 10.0.114 and Runtime 10.0.14 (JIRA:RHEL-291741)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 10.0.114
Runtime version: 10.0.14

Security Fix(es):

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 10.0 to SDK 10.0.114 and Runtime 10.0.14 [rhel-9.8.z] (JIRA:RHEL-291744)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 10.0.114
Runtime version: 10.0.14

Security Fix(es):

• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 10.0 to SDK 10.0.114 and Runtime 10.0.14 [rhel-10.2.z] (JIRA:RHEL-291745)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 8.0.133
Runtime version: 8.0.33

Security Fix(es):

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 [rhel-9.8.z] (JIRA:RHEL-291717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.

SDK version: 11.0.100rc.3.26522.148
Runtime version: 11.0.0rc.3.26522.148

Security Fix(es):

• .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909)
• dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)

Bug Fix(es) and Enhancement(s):

• Update .NET 11 to RC 1 (JIRA:RHEL-260220)
• Update .NET 11 to RC 2 (JIRA:RHEL-276919)
• Update .NET 11 to RC 3 (JIRA:RHEL-292372)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

It was discovered that the .NET Blazor WebAssembly debug proxy did not properly escape certain values. An attacker could possibly use this issue to execute arbitrary code. The fix for this CVE was originally released via USN-8942-1, but it was found to be incomplete. This issue only affected dotnet10 and dotnet11. (CVE-2026-102870)

It was discovered that the Brotli decompression library used by .NET incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-111497)

Alen Cheung discovered that .NET did not properly handle file ownership in certain circumstances. An attacker could possibly use this issue to elevate local privileges. (CVE-2026-114148)