CVE-2026-114155

Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally.

Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET SDK's dotnet-watch component. This advisory provides guidance on updating affected SDK installations.

A local attacker who can replace or modify a temporary solution file used by dotnet-watch can alter a subsequent build. The fix stores generated solution files in a private temporary directory and keeps each file open with read-only sharing while the build uses it.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/502

CVSS Details

• Version: 3.1
• Severity: High
• Score: 7.5 (base score)
• Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness: CWE-367
• MSRC severity: Important
• Impact: Elevation of Privilege

Affected Platforms

• Platforms: Linux, macOS.
• Architectures: Linux: Arm, Arm64, x64; macOS: Arm64, x64

Windows is outside this advisory's affected scope when its temporary directory is private to the current user, as assumed by the implementation. Shared or insecurely configured Windows temporary directories are not covered by that assumption.

<a name="affected-packages"></a>Affected Packages

The .NET SDK includes dotnet-watch and the Microsoft.DotNet.HotReload.Watch assembly.

Each SDK feature band is a separate servicing line. Update an affected 10.0.3xx installation to the fixed 10.0.4xx SDK listed below.

.NET SDK 10.0.3xx

Package | Affected version | Patched version --- | --- | --- .NET SDK (dotnet-watch) 10.0.3xx | >= 10.0.300, <= 10.0.303 | 10.0.404

.NET SDK 10.0.4xx

Package | Affected version | Patched version --- | --- | --- .NET SDK (dotnet-watch) 10.0.4xx | >= 10.0.400, <= 10.0.403 | 10.0.404

.NET SDK 11.0.1xx

Package | Affected version | Patched version --- | --- | --- .NET SDK (dotnet-watch) 11.0.1xx | >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148 | 11.0.100

Separately restored Aspire watch tool

Package | Affected version | Patched version --- | --- | --- Microsoft.DotNet.HotReload.Watch.Aspire | >= 10.0.300, <= 10.0.303 | 10.0.404 Microsoft.DotNet.HotReload.Watch.Aspire | >= 10.0.400, <= 10.0.403 | 10.0.404 Microsoft.DotNet.HotReload.Watch.Aspire | >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148 | 11.0.100

This tool has its own copy of the watch implementation. Updating the SDK does not necessarily replace a separately restored tool.

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Run dotnet --version from the directory where you run dotnet-watch to identify the selected SDK. Use dotnet --info and dotnet --list-sdks to check its installation path, OS, architecture, and other installed SDKs. Check the nearest applicable global.json, including its version and rollForward settings: installing a newer SDK does not necessarily change the SDK selected for a pinned project. See .NET SDK selection.

Review use of dotnet-watch against the affected intervals above. Membership in a listed feature band alone does not establish that a specific SDK version is vulnerable. For Aspire or other tooling that separately restores Microsoft.DotNet.HotReload.Watch.Aspire, check the actual restored package version separately from the selected SDK.

<a name="how-fix"></a>How do I fix the issue?

The fixed SDK versions are 10.0.404 and 11.0.100, as applicable. Update each affected SDK installation and restart dotnet-watch. For SDKs…

Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally.

Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET SDK's dotnet-watch component. This advisory provides guidance on updating affected SDK installations.

A local attacker who can replace or modify a temporary solution file used by dotnet-watch can alter a subsequent build. The fix stores generated solution files in a private temporary directory and keeps each file open with read-only sharing while the build uses it.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/502

CVSS Details

• Version: 3.1
• Severity: High
• Score: 7.5 (base score)
• Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness: CWE-367
• MSRC severity: Important
• Impact: Elevation of Privilege

Affected Platforms

• Platforms: Linux, macOS.
• Architectures: Linux: Arm, Arm64, x64; macOS: Arm64, x64

Windows is outside this advisory's affected scope when its temporary directory is private to the current user, as assumed by the implementation. Shared or insecurely configured Windows temporary directories are not covered by that assumption.

<a name="affected-packages"></a>Affected Packages

The .NET SDK includes dotnet-watch and the Microsoft.DotNet.HotReload.Watch assembly.

Each SDK feature band is a separate servicing line. Update an affected 10.0.3xx installation to the fixed 10.0.4xx SDK listed below.

.NET SDK 10.0.3xx

Package | Affected version | Patched version --- | --- | --- .NET SDK (dotnet-watch) 10.0.3xx | >= 10.0.300, <= 10.0.303 | 10.0.404

.NET SDK 10.0.4xx

Package | Affected version | Patched version --- | --- | --- .NET SDK (dotnet-watch) 10.0.4xx | >= 10.0.400, <= 10.0.403 | 10.0.404

.NET SDK 11.0.1xx

Package | Affected version | Patched version --- | --- | --- .NET SDK (dotnet-watch) 11.0.1xx | >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148 | 11.0.100

Separately restored Aspire watch tool

Package | Affected version | Patched version --- | --- | --- Microsoft.DotNet.HotReload.Watch.Aspire | >= 10.0.300, <= 10.0.303 | 10.0.404 Microsoft.DotNet.HotReload.Watch.Aspire | >= 10.0.400, <= 10.0.403 | 10.0.404 Microsoft.DotNet.HotReload.Watch.Aspire | >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148 | 11.0.100

This tool has its own copy of the watch implementation. Updating the SDK does not necessarily replace a separately restored tool.

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Run dotnet --version from the directory where you run dotnet-watch to identify the selected SDK. Use dotnet --info and dotnet --list-sdks to check its installation path, OS, architecture, and other installed SDKs. Check the nearest applicable global.json, including its version and rollForward settings: installing a newer SDK does not necessarily change the SDK selected for a pinned project. See .NET SDK selection.

Review use of dotnet-watch against the affected intervals above. Membership in a listed feature band alone does not establish that a specific SDK version is vulnerable. For Aspire or other tooling that separately restores Microsoft.DotNet.HotReload.Watch.Aspire, check the actual restored package version separately from the selected SDK.

<a name="how-fix"></a>How do I fix the issue?

The fixed SDK versions are 10.0.404 and 11.0.100, as applicable. Update each affected SDK installation and restart dotnet-watch. For SDKs…

Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally.

Multiple security issues were discovered in .NET and this update includes new upstream .NET versions to fix these issues.

.NET 8 has been updated to 8.0.34 in Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. .NET 10 has been updated to 10.0.15 in Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. .NET 11 has been updated to 11.0.0 in Ubuntu 26.10.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.