CVE-2026-96234
.NET Information Disclosure Vulnerability
CVE-2026-96234 is a medium vulnerability (CVSS 5.3) in Microsoft .net 10.0 Runtime, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in Microsoft.WindowsDesktop.App.Runtime.win-arm64 9.0.21.
- Severity
- 5.3 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.33%EPSS, 26th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
9.0.21Microsoft.WindowsDesktop.App.Runtime.win-arm64 +37 more
Description
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet | 9.0.0 to 9.0.20 | 9.0.21 |
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet | 9.0.0 to 9.0.20 | 9.0.21 |
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet | 9.0.0 to 9.0.20 | 9.0.21 |
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet | 10.0.0 to 10.0.12 | 10.0.13 |
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet | 10.0.0 to 10.0.12 | 10.0.13 |
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet | 10.0.0 to 10.0.12 | 10.0.13 |
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet | 8.0.0 to 8.0.31 | 8.0.32 |
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet | 8.0.0 to 8.0.31 | 8.0.32 |
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet | 8.0.0 to 8.0.31 | 8.0.32 |
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet | 11.0.0-preview.1 to 11.0.0-rc.1 | 11.0.0-rc.2 |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet | 11.0.0-preview.1 to 11.0.0-rc.1 | 11.0.0-rc.2 |
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet | 11.0.0-preview.1 to 11.0.0-rc.1 | 11.0.0-rc.2 |
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet | 9.0.0 up to 9.0.21, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 15 moreShow less9.0.149.0.159.0.169.0.179.0.189.0.199.0.29.0.209.0.39.0.49.0.59.0.69.0.79.0.89.0.9 | 9.0.21 |
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet | 9.0.0 up to 9.0.21, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 15 moreShow less9.0.149.0.159.0.169.0.179.0.189.0.199.0.29.0.209.0.39.0.49.0.59.0.69.0.79.0.89.0.9 | 9.0.21 |
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet | 9.0.0 up to 9.0.21, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 15 moreShow less9.0.149.0.159.0.169.0.179.0.189.0.199.0.29.0.209.0.39.0.49.0.59.0.69.0.79.0.89.0.9 | 9.0.21 |
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet | 10.0.0 up to 10.0.13, plus listed versions 10.0.110.0.1010.0.1110.0.1210.0.2 Show 7 moreShow less10.0.310.0.410.0.510.0.610.0.710.0.810.0.9 | 10.0.13 |
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet | 10.0.0 up to 10.0.13, plus listed versions 10.0.110.0.1010.0.1110.0.1210.0.2 Show 7 moreShow less10.0.310.0.410.0.510.0.610.0.710.0.810.0.9 | 10.0.13 |
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet | 10.0.0 up to 10.0.13, plus listed versions 10.0.110.0.1010.0.1110.0.1210.0.2 Show 7 moreShow less10.0.310.0.410.0.510.0.610.0.710.0.810.0.9 | 10.0.13 |
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet | 8.0.0 up to 8.0.32, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 25 moreShow less8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.298.0.38.0.308.0.318.0.48.0.58.0.68.0.78.0.8 | 8.0.32 |
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet | 8.0.0 up to 8.0.32, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 25 moreShow less8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.298.0.38.0.308.0.318.0.48.0.58.0.68.0.78.0.8 | 8.0.32 |
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet | 8.0.0 up to 8.0.32, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 25 moreShow less8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.298.0.38.0.308.0.318.0.48.0.58.0.68.0.78.0.8 | 8.0.32 |
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet | 11.0.0-preview.1 up to 11.0.0-rc.2 | 11.0.0-rc.2 |
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet | 11.0.0-preview.1 up to 11.0.0-rc.2 | 11.0.0-rc.2 |
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet | 11.0.0-preview.1 up to 11.0.0-rc.2 | 11.0.0-rc.2 |
dotnet-sdk-8.0Red Hat:hummingbird:1 From an advisory covering 19 CVEs | before 0:8.0.132-0.1.hum1 | 0:8.0.132-0.1.hum1 |
dotnet-sdk-8.0-source-built-artifactsRed Hat:hummingbird:1 From an advisory covering 19 CVEs | before 0:8.0.132-0.1.hum1 | 0:8.0.132-0.1.hum1 |
dotnet-sdk-dbg-8.0Red Hat:hummingbird:1 From an advisory covering 19 CVEs | before 0:8.0.132-0.1.hum1 | 0:8.0.132-0.1.hum1 |
dotnet-templates-8.0Red Hat:hummingbird:1 From an advisory covering 19 CVEs | before 0:8.0.132-0.1.hum1 | 0:8.0.132-0.1.hum1 |
dotnet8.0Red Hat:hummingbird:1 From an advisory covering 19 CVEs | before 0:8.0.132-0.1.hum1 | 0:8.0.132-0.1.hum1 |
aspnetcore-runtime-8.0Red Hat:hummingbird:1 From an advisory covering 19 CVEs | before 0:8.0.32-0.1.hum1 | 0:8.0.32-0.1.hum1 |
aspnetcore-runtime-dbg-8.0Red Hat:hummingbird:1 From an advisory covering 19 CVEs | before 0:8.0.32-0.1.hum1 | 0:8.0.32-0.1.hum1 |
aspnetcore-targeting-pack-8.0Red Hat:hummingbird:1 From an advisory covering 19 CVEs | before 0:8.0.32-0.1.hum1 | 0:8.0.32-0.1.hum1 |
dotnet-apphost-pack-8.0Red Hat:hummingbird:1 From an advisory covering 19 CVEs | before 0:8.0.32-0.1.hum1 | 0:8.0.32-0.1.hum1 |
dotnet-hostfxr-8.0Red Hat:hummingbird:1 From an advisory covering 19 CVEs | before 0:8.0.32-0.1.hum1 | 0:8.0.32-0.1.hum1 |
dotnet-runtime-8.0Red Hat:hummingbird:1 From an advisory covering 19 CVEs | before 0:8.0.32-0.1.hum1 | 0:8.0.32-0.1.hum1 |
dotnet-runtime-dbg-8.0Red Hat:hummingbird:1 From an advisory covering 19 CVEs | before 0:8.0.32-0.1.hum1 | 0:8.0.32-0.1.hum1 |
dotnet-targeting-pack-8.0Red Hat:hummingbird:1 From an advisory covering 19 CVEs | before 0:8.0.32-0.1.hum1 | 0:8.0.32-0.1.hum1 |
dotnet7Ubuntu:22.04:LTS | All versions, plus listed versions 7.0.105-0ubuntu1~22.04.17.0.107-0ubuntu1~22.04.17.0.108-0ubuntu1~22.04.17.0.109-0ubuntu1~22.04.17.0.110-0ubuntu1~22.04.1 Show 9 moreShow less7.0.111-0ubuntu1~22.04.17.0.112-0ubuntu1~22.04.17.0.113-0ubuntu1~22.04.17.0.114-0ubuntu1~22.04.17.0.115-0ubuntu1~22.04.17.0.116-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.27.0.119-0ubuntu1~22.04.1 | None known |
What each source reports
CVE List Score used
.NET Information Disclosure Vulnerability
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
- Record
CVE-2026-96234- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - Weakness
- CWE-346
- Updated
- 2026-11-10
EUVDEUVD-2026-100207
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
- Record
EUVD-2026-100207- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - Updated
- 2026-11-10
GitHub AdvisoriesGHSA-fq6x-pvr9-888r
Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Restrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigation, add TrueType font protection and XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions.
Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/482
CVSS Details
- Version: 3.1
- Severity: Moderate
- Score: 5.3
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness: CWE-346 (Origin Validation Error)
Affected Platforms
- Platforms: Windows
- Architectures: All
<a name="affected-packages"></a>Affected Packages
The vulnerability affects Microsoft .NET projects that use an affected package version listed below.
Package name | Affected version | Patched version ------------ | ---------------- | --------------- Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2
Advisory FAQ
<a name="how-affected"></a>How do I know if I am affected?
If using a package listed in affected packages, you're exposed to the vulnerability.
<a name="how-fix"></a>How do I fix the issue?
- To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.
- If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the
dotnet --infocommand.
Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.
Additionally, if you've deployed [self-contained…
- Record
GHSA-fq6x-pvr9-888r- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
NVD
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
- Record
CVE-2026-96234- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
OSVGHSA-fq6x-pvr9-888r
Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Restrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigation, add TrueType font protection and XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions.
Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/482
CVSS Details
- Version: 3.1
- Severity: Moderate
- Score: 5.3
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness: CWE-346 (Origin Validation Error)
Affected Platforms
- Platforms: Windows
- Architectures: All
<a name="affected-packages"></a>Affected Packages
The vulnerability affects Microsoft .NET projects that use an affected package version listed below.
Package name | Affected version | Patched version ------------ | ---------------- | --------------- Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.20 | 9.0.21 Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.31 | 8.0.32 Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2
Advisory FAQ
<a name="how-affected"></a>How do I know if I am affected?
If using a package listed in affected packages, you're exposed to the vulnerability.
<a name="how-fix"></a>How do I fix the issue?
- To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.
- If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the
dotnet --infocommand.
Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.
Additionally, if you've deployed [self-contained…
- Record
GHSA-fq6x-pvr9-888r- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
OSVRHSA-2026:84693
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:84693- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-96234
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
- Record
UBUNTU-CVE-2026-96234- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96234
github.com/dotnet/wpf/security/advisories/GHSA-fq6x-pvr9-888r
nvd.nist.gov/vuln/detail/CVE-2026-96234
Show 90 moreShow less
access.redhat.com/errata/RHSA-2026:84693
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84693.json
bugzilla.redhat.com/show_bug.cgi?id=2548778
cve.org/CVERecord?id=CVE-2026-58280
ubuntu.com/security/CVE-2026-96234
devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-october-2026-servicing-updates
Left out here: the rest of 2 source descriptions. The JSON record has them.