CVE catalog
CVE-2026-32203
Stack-based buffer overflow in .NET and Visual Studio…
Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.90% · Oct 27, 2026
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| UnknownRelease not reported | .net | 10.0.6 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | .net | 8.0.26 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | .net | 9.0.15 | UnknownSource applicability is not established | Provider not reported |
| NugetRelease not reported | System.Security.Cryptography.Xml | 10.0.6 | UnknownSource applicability is not established | Provider not reported |
| NugetRelease not reported | System.Security.Cryptography.Xml | 8.0.3 | UnknownSource applicability is not established | Provider not reported |
| NugetRelease not reported | System.Security.Cryptography.Xml | 9.0.15 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | aspnetcore-runtime-10.0 | 10.0.6-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | aspnetcore-runtime-8.0 | 8.0.26-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | aspnetcore-runtime-dbg-10.0 | 10.0.6-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | aspnetcore-runtime-dbg-8.0 | 8.0.26-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | aspnetcore-targeting-pack-10.0 | 10.0.6-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | aspnetcore-targeting-pack-8.0 | 8.0.26-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
Showing 12 observations. All 39 observations, including unknown and conflicting reports, are available below.
Provider details and historical evidence
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| UnknownRelease not reported | .net | 10.0.6 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | .net | 8.0.26 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | .net | 9.0.15 | UnknownSource applicability is not established | Provider not reported |
| NugetRelease not reported | System.Security.Cryptography.Xml | 10.0.6 | UnknownSource applicability is not established | Provider not reported |
| NugetRelease not reported | System.Security.Cryptography.Xml | 8.0.3 | UnknownSource applicability is not established | Provider not reported |
| NugetRelease not reported | System.Security.Cryptography.Xml | 9.0.15 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | aspnetcore-runtime-10.0 | 10.0.6-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | aspnetcore-runtime-8.0 | 8.0.26-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | aspnetcore-runtime-dbg-10.0 | 10.0.6-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | aspnetcore-runtime-dbg-8.0 | 8.0.26-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | aspnetcore-targeting-pack-10.0 | 10.0.6-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | aspnetcore-targeting-pack-8.0 | 8.0.26-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-apphost-pack-10.0 | 10.0.6-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-apphost-pack-8.0 | 8.0.26-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-host-10.0 | 10.0.6-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-host-8.0 | 8.0.26-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-hostfxr-10.0 | 10.0.6-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-hostfxr-8.0 | 8.0.26-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-runtime-10.0 | 10.0.6-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-runtime-8.0 | 8.0.26-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-runtime-dbg-10.0 | 10.0.6-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-runtime-dbg-8.0 | 8.0.26-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-sdk-10.0 | 10.0.106-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-sdk-10.0-source-built-artifacts | 10.0.106-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-sdk-8.0 | 8.0.126-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-sdk-8.0-source-built-artifacts | 8.0.126-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-sdk-aot-10.0 | 10.0.106-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-sdk-dbg-10.0 | 10.0.106-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-sdk-dbg-8.0 | 8.0.126-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-targeting-pack-10.0 | 10.0.6-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-targeting-pack-8.0 | 8.0.26-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-templates-10.0 | 10.0.106-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet-templates-8.0 | 8.0.126-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet10 | 10.0.106-10.0.6-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | dotnet8 | 8.0.126-8.0.26-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | netstandard-targeting-pack-2.1-8.0 | 8.0.126-0ubuntu1~24.04.1 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | visual_studio_2022 | 17.12.19 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | visual_studio_2022 | 17.14.30 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | visual_studio_2026 | 18.4.4 | UnknownSource applicability is not established | Provider not reported |
Original provider fields
{
"package_releases": [],
"fixed_versions": [],
"distribution_packages": [
{
"name": "dotnet10",
"fixed_version": "10.0.106-10.0.6-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet8",
"fixed_version": "8.0.126-8.0.26-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "aspnetcore-runtime-10.0",
"fixed_version": "10.0.6-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "aspnetcore-runtime-8.0",
"fixed_version": "8.0.26-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "aspnetcore-runtime-dbg-10.0",
"fixed_version": "10.0.6-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "aspnetcore-runtime-dbg-8.0",
"fixed_version": "8.0.26-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "aspnetcore-targeting-pack-10.0",
"fixed_version": "10.0.6-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "aspnetcore-targeting-pack-8.0",
"fixed_version": "8.0.26-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-apphost-pack-10.0",
"fixed_version": "10.0.6-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-apphost-pack-8.0",
"fixed_version": "8.0.26-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-host-10.0",
"fixed_version": "10.0.6-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-host-8.0",
"fixed_version": "8.0.26-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-hostfxr-10.0",
"fixed_version": "10.0.6-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-hostfxr-8.0",
"fixed_version": "8.0.26-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-runtime-10.0",
"fixed_version": "10.0.6-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-runtime-8.0",
"fixed_version": "8.0.26-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-runtime-dbg-10.0",
"fixed_version": "10.0.6-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-runtime-dbg-8.0",
"fixed_version": "8.0.26-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-sdk-10.0",
"fixed_version": "10.0.106-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-sdk-10.0-source-built-artifacts",
"fixed_version": "10.0.106-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-sdk-8.0",
"fixed_version": "8.0.126-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-sdk-8.0-source-built-artifacts",
"fixed_version": "8.0.126-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-sdk-aot-10.0",
"fixed_version": "10.0.106-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-sdk-dbg-10.0",
"fixed_version": "10.0.106-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-sdk-dbg-8.0",
"fixed_version": "8.0.126-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-targeting-pack-10.0",
"fixed_version": "10.0.6-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-targeting-pack-8.0",
"fixed_version": "8.0.26-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-templates-10.0",
"fixed_version": "10.0.106-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "dotnet-templates-8.0",
"fixed_version": "8.0.126-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": "netstandard-targeting-pack-2.1-8.0",
"fixed_version": "8.0.126-0ubuntu1~24.04.1",
"applicability_unknown": true
},
{
"name": ".net",
"fixed_version": "10.0.6",
"applicability_unknown": true
},
{
"name": ".net",
"fixed_version": "8.0.26",
"applicability_unknown": true
},
{
"name": ".net",
"fixed_version": "9.0.15",
"applicability_unknown": true
},
{
"name": "visual_studio_2022",
"fixed_version": "17.12.19",
"applicability_unknown": true
},
{
"name": "visual_studio_2022",
"fixed_version": "17.14.30",
"applicability_unknown": true
},
{
"name": "visual_studio_2026",
"fixed_version": "18.4.4",
"applicability_unknown": true
},
{
"name": "System.Security.Cryptography.Xml",
"ecosystem": "nuget",
"fixed_version": "10.0.6",
"applicability_unknown": true
},
{
"name": "System.Security.Cryptography.Xml",
"ecosystem": "nuget",
"fixed_version": "9.0.15",
"applicability_unknown": true
},
{
"name": "System.Security.Cryptography.Xml",
"ecosystem": "nuget",
"fixed_version": "8.0.3",
"applicability_unknown": true
},
{
"name": ".net",
"ranges": [
{
"fixed": "9.0.15",
"introduced": "9.0.0",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32203",
"fixed_version": "9.0.15",
"provider_source": "nvd",
"provider_record_id": "NVD-CVE-2026-32203",
"provider_updated_at": "2026-10-26T21:10:00.170"
},
{
"name": "visual_studio_2022",
"ranges": [
{
"fixed": "17.14.30",
"introduced": "17.14.0",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32203",
"fixed_version": "17.14.30",
"provider_source": "nvd",
"provider_record_id": "NVD-CVE-2026-32203",
"provider_updated_at": "2026-10-26T21:10:00.170"
},
{
"name": "visual_studio_2026",
"ranges": [
{
"fixed": "18.4.4",
"introduced": "18.4.0",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32203",
"fixed_version": "18.4.4",
"provider_source": "nvd",
"provider_record_id": "NVD-CVE-2026-32203",
"provider_updated_at": "2026-10-26T21:10:00.170"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
Observed:
References
- [https://access.redhat.com/errata/RHSA-2026:13280]
- [https://access.redhat.com/errata/RHSA-2026:13281]
- [https://access.redhat.com/errata/RHSA-2026:13282]
- [https://access.redhat.com/errata/RHSA-2026:13283]
- [https://access.redhat.com/errata/RHSA-2026:13693]
- [https://access.redhat.com/errata/RHSA-2026:8467]
- [https://access.redhat.com/errata/RHSA-2026:8468]
- [https://access.redhat.com/errata/RHSA-2026:8469]
- [https://access.redhat.com/errata/RHSA-2026:8470]
- [https://access.redhat.com/errata/RHSA-2026:8471]
- [https://access.redhat.com/errata/RHSA-2026:8472]
- [https://access.redhat.com/errata/RHSA-2026:8473]
- [https://access.redhat.com/errata/RHSA-2026:8474]
- [https://access.redhat.com/errata/RHSA-2026:8475]
- [https://access.redhat.com/errata/RHSA-2026:9077]
- [https://access.redhat.com/errata/RHSA-2026:9080]
- [https://access.redhat.com/errata/RHSA-2026:9205]
- [https://access.redhat.com/security/cve/CVE-2026-32203]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2457740]
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_8467.json]
- [https://github.com/advisories/GHSA-6588-8gv4-xfgh]
- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32203]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-32203]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32203.json]
- [https://ubuntu.com/security/notices/USN-8176-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1100.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]