CVE catalog

CVE-2026-50526

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

[CVE catalog]

Severity
High · CVSS 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.22% · Oct 25, 2026

A flaw was found in .NET. This vulnerability, stemming from improper link resolution before file access, allows an authorized local attacker to perform tampering. This could lead to unauthorized modification of data or system files. dotnet: .NET: Local tampering via improper link resolution The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cpedotnet10Not reported10.0.110-10.0.10-0ubuntu1~24.04.1fixed
Cpedotnet8Not reported8.0.129-8.0.29-0ubuntu1~24.04.1fixed
Cpeaspnetcore-runtime-10.0Not reported10.0.10-0ubuntu1~24.04.1fixed
Cpeaspnetcore-runtime-8.0Not reported8.0.29-0ubuntu1~24.04.1fixed
Cpeaspnetcore-runtime-dbg-10.0Not reported10.0.10-0ubuntu1~24.04.1fixed
Cpeaspnetcore-runtime-dbg-8.0Not reported8.0.29-0ubuntu1~24.04.1fixed
Cpeaspnetcore-targeting-pack-10.0Not reported10.0.10-0ubuntu1~24.04.1fixed
Cpeaspnetcore-targeting-pack-8.0Not reported8.0.29-0ubuntu1~24.04.1fixed
Cpedotnet-apphost-pack-10.0Not reported10.0.10-0ubuntu1~24.04.1fixed
Cpedotnet-apphost-pack-8.0Not reported8.0.29-0ubuntu1~24.04.1fixed
Cpedotnet-host-10.0Not reported10.0.10-0ubuntu1~24.04.1fixed
Cpedotnet-host-8.0Not reported8.0.29-0ubuntu1~24.04.1fixed
Cpedotnet-hostfxr-10.0Not reported10.0.10-0ubuntu1~24.04.1fixed
Cpedotnet-hostfxr-8.0Not reported8.0.29-0ubuntu1~24.04.1fixed
Cpedotnet-runtime-10.0Not reported10.0.10-0ubuntu1~24.04.1fixed
Cpedotnet-runtime-8.0Not reported8.0.29-0ubuntu1~24.04.1fixed
Cpedotnet-runtime-dbg-10.0Not reported10.0.10-0ubuntu1~24.04.1fixed
Cpedotnet-runtime-dbg-8.0Not reported8.0.29-0ubuntu1~24.04.1fixed
Cpedotnet-sdk-10.0Not reported10.0.110-0ubuntu1~24.04.1fixed
Cpedotnet-sdk-10.0-source-built-artifactsNot reported10.0.110-0ubuntu1~24.04.1fixed
Cpedotnet-sdk-8.0Not reported8.0.129-0ubuntu1~24.04.1fixed
Cpedotnet-sdk-8.0-source-built-artifactsNot reported8.0.129-0ubuntu1~24.04.1fixed
Cpedotnet-sdk-aot-10.0Not reported10.0.110-0ubuntu1~24.04.1fixed
Cpedotnet-sdk-dbg-10.0Not reported10.0.110-0ubuntu1~24.04.1fixed
Cpedotnet-sdk-dbg-8.0Not reported8.0.129-0ubuntu1~24.04.1fixed
Cpedotnet-targeting-pack-10.0Not reported10.0.10-0ubuntu1~24.04.1fixed
Cpedotnet-targeting-pack-8.0Not reported8.0.29-0ubuntu1~24.04.1fixed
Cpedotnet-templates-10.0Not reported10.0.110-0ubuntu1~24.04.1fixed
Cpedotnet-templates-8.0Not reported8.0.129-0ubuntu1~24.04.1fixed
Cpenetstandard-targeting-pack-2.1-8.0Not reported8.0.129-0ubuntu1~24.04.1fixed
NugetMicrosoft.NET.Build.ContainersNot reported10.0.10fixed
NugetMicrosoft.NET.Build.ContainersNot reported9.0.18fixed
NugetMicrosoft.NET.Build.ContainersNot reported8.0.29fixed
Ubuntudotnet622.046.0.108-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.109-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.110-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.111-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.113-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.116-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.118-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.119-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.120-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.121-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.122-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.123-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.124-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.125-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.126-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.127-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.128-0ubuntu1~22.04.2vulnerable
Ubuntudotnet622.046.0.132-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.133-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.135-0ubuntu1~22.04.1vulnerable
Ubuntudotnet622.046.0.136-0ubuntu1~22.04.1vulnerable
Ubuntudotnet722.047.0.105-0ubuntu1~22.04.1vulnerable
Ubuntudotnet722.047.0.107-0ubuntu1~22.04.1vulnerable
Ubuntudotnet722.047.0.108-0ubuntu1~22.04.1vulnerable
Ubuntudotnet722.047.0.109-0ubuntu1~22.04.1vulnerable
Ubuntudotnet722.047.0.110-0ubuntu1~22.04.1vulnerable
Ubuntudotnet722.047.0.111-0ubuntu1~22.04.1vulnerable
Ubuntudotnet722.047.0.112-0ubuntu1~22.04.1vulnerable
Ubuntudotnet722.047.0.113-0ubuntu1~22.04.1vulnerable
Ubuntudotnet722.047.0.114-0ubuntu1~22.04.1vulnerable
Ubuntudotnet722.047.0.115-0ubuntu1~22.04.1vulnerable
Ubuntudotnet722.047.0.116-0ubuntu1~22.04.1vulnerable
Ubuntudotnet722.047.0.117-0ubuntu1~22.04.1vulnerable
Ubuntudotnet722.047.0.117-0ubuntu1~22.04.2vulnerable
Ubuntudotnet722.047.0.119-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.102-8.0.2-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.103-8.0.3-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.103-8.0.3-0ubuntu1~22.04.2vulnerable
Ubuntudotnet822.048.0.105-8.0.5-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.107-8.0.7-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.108-8.0.8-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.110-8.0.10-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.111-8.0.11-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.112-8.0.12-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.114-8.0.14-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.115-8.0.15-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.116-8.0.16-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.117-8.0.17-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.118-8.0.18-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.119-8.0.19-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.120-8.0.20-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.121-8.0.21-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.122-8.0.22-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.123-8.0.23-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.124-8.0.24-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.125-8.0.25-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.126-8.0.26-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.127-8.0.27-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.128-8.0.28-0ubuntu1~22.04.1vulnerable
Ubuntudotnet822.048.0.129-8.0.29-0ubuntu1~22.04.1fixed
Ubuntudotnet1024.0410.0.100-10.0.0-0ubuntu1~24.04.1vulnerable
Ubuntudotnet1024.0410.0.101-10.0.1-0ubuntu1~24.04.2vulnerable
Ubuntudotnet1024.0410.0.103-10.0.3-0ubuntu1~24.04.1vulnerable
Ubuntudotnet1024.0410.0.104-10.0.4-0ubuntu1~24.04.1vulnerable
Ubuntudotnet1024.0410.0.105-10.0.5-0ubuntu1~24.04.1vulnerable
Ubuntudotnet1024.0410.0.106-10.0.6-0ubuntu1~24.04.1vulnerable
Ubuntudotnet1024.0410.0.107-10.0.7-0ubuntu1~24.04.1vulnerable
Ubuntudotnet1024.0410.0.108-10.0.8-0ubuntu1~24.04.1vulnerable
Ubuntudotnet1024.0410.0.109-10.0.9-0ubuntu1~24.04.1vulnerable
Ubuntudotnet1024.0410.0.110-10.0.10-0ubuntu1~24.04.1fixed
Ubuntudotnet824.048.0.100-8.0.0~rc1-0ubuntu1vulnerable
Ubuntudotnet824.048.0.100-8.0.0~rc2-0ubuntu1vulnerable
Ubuntudotnet824.048.0.100-8.0.0~rc2-0ubuntu2vulnerable
Ubuntudotnet824.048.0.100-8.0.0-0ubuntu1vulnerable
Ubuntudotnet824.048.0.100-8.0.0-0ubuntu2vulnerable
Ubuntudotnet824.048.0.101-8.0.1-0ubuntu1vulnerable
Ubuntudotnet824.048.0.101-8.0.1-0ubuntu2vulnerable
Ubuntudotnet824.048.0.102-8.0.2-0ubuntu1vulnerable
Ubuntudotnet824.048.0.103-8.0.3-0ubuntu2vulnerable
Ubuntudotnet824.048.0.103-8.0.3-0ubuntu3vulnerable
Ubuntudotnet824.048.0.104-8.0.4-0ubuntu1vulnerable
Ubuntudotnet824.048.0.105-8.0.5-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.107-8.0.7-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.108-8.0.8-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.108-8.0.8-0ubuntu1~24.04.2vulnerable
Ubuntudotnet824.048.0.110-8.0.10-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.111-8.0.11-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.112-8.0.12-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.114-8.0.14-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.115-8.0.15-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.116-8.0.16-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.117-8.0.17-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.118-8.0.18-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.119-8.0.19-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.120-8.0.20-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.121-8.0.21-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.122-8.0.22-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.123-8.0.23-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.124-8.0.24-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.125-8.0.25-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.126-8.0.26-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.127-8.0.27-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.128-8.0.28-0ubuntu1~24.04.1vulnerable
Ubuntudotnet824.048.0.129-8.0.29-0ubuntu1~24.04.1fixed
Ubuntudotnet1026.0410.0.100-10.0.0~rc1-0ubuntu1vulnerable
Ubuntudotnet1026.0410.0.100-10.0.0~rc2-0ubuntu1vulnerable
Ubuntudotnet1026.0410.0.100-10.0.0-0ubuntu1vulnerable
Ubuntudotnet1026.0410.0.100-10.0.0-0ubuntu2vulnerable
Ubuntudotnet1026.0410.0.101-10.0.1-0ubuntu1vulnerable
Ubuntudotnet1026.0410.0.101-10.0.1-0ubuntu2vulnerable
Ubuntudotnet1026.0410.0.101-10.0.1-0ubuntu3vulnerable
Ubuntudotnet1026.0410.0.102-10.0.2-0ubuntu1vulnerable
Ubuntudotnet1026.0410.0.103-10.0.3-0ubuntu1vulnerable
Ubuntudotnet1026.0410.0.104-10.0.4-0ubuntu1vulnerable
Ubuntudotnet1026.0410.0.105-10.0.5-0ubuntu1vulnerable
Ubuntudotnet1026.0410.0.107-10.0.7-0ubuntu1~26.04.1vulnerable
Ubuntudotnet1026.0410.0.108-10.0.8-0ubuntu1~26.04.1vulnerable
Ubuntudotnet1026.0410.0.109-10.0.9-0ubuntu1~26.04.1vulnerable
Ubuntudotnet1026.0410.0.110-10.0.10-0ubuntu1~26.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Cpedotnet10cpeNot reported10.0.110-10.0.10-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet8cpeNot reported8.0.129-8.0.29-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpeaspnetcore-runtime-10.0cpeNot reported10.0.10-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpeaspnetcore-runtime-8.0cpeNot reported8.0.29-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpeaspnetcore-runtime-dbg-10.0cpeNot reported10.0.10-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpeaspnetcore-runtime-dbg-8.0cpeNot reported8.0.29-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpeaspnetcore-targeting-pack-10.0cpeNot reported10.0.10-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpeaspnetcore-targeting-pack-8.0cpeNot reported8.0.29-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-apphost-pack-10.0cpeNot reported10.0.10-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-apphost-pack-8.0cpeNot reported8.0.29-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-host-10.0cpeNot reported10.0.10-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-host-8.0cpeNot reported8.0.29-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-hostfxr-10.0cpeNot reported10.0.10-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-hostfxr-8.0cpeNot reported8.0.29-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-runtime-10.0cpeNot reported10.0.10-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-runtime-8.0cpeNot reported8.0.29-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-runtime-dbg-10.0cpeNot reported10.0.10-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-runtime-dbg-8.0cpeNot reported8.0.29-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-sdk-10.0cpeNot reported10.0.110-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-sdk-10.0-source-built-artifactscpeNot reported10.0.110-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-sdk-8.0cpeNot reported8.0.129-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-sdk-8.0-source-built-artifactscpeNot reported8.0.129-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-sdk-aot-10.0cpeNot reported10.0.110-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-sdk-dbg-10.0cpeNot reported10.0.110-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-sdk-dbg-8.0cpeNot reported8.0.129-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-targeting-pack-10.0cpeNot reported10.0.10-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-targeting-pack-8.0cpeNot reported8.0.29-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-templates-10.0cpeNot reported10.0.110-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpedotnet-templates-8.0cpeNot reported8.0.129-0ubuntu1~24.04.1Not reportedNot reportedNot reported
Cpenetstandard-targeting-pack-2.1-8.0cpeNot reported8.0.129-0ubuntu1~24.04.1Not reportedNot reportedNot reported
NugetMicrosoft.NET.Build.ContainersnugetNot reported10.0.10Not reportedNot reportedNot reported
NugetMicrosoft.NET.Build.ContainersnugetNot reported9.0.18Not reportedNot reportedNot reported
NugetMicrosoft.NET.Build.ContainersnugetNot reported8.0.29Not reportedNot reportedNot reported
Ubuntudotnet8deb22.048.0.129-8.0.29-0ubuntu1~22.04.1Not reportedUBUNTU-CVE-2026-50526Not reported
Ubuntudotnet10deb24.0410.0.110-10.0.10-0ubuntu1~24.04.1Not reportedUBUNTU-CVE-2026-50526Not reported
Ubuntudotnet8deb24.048.0.129-8.0.29-0ubuntu1~24.04.1Not reportedUBUNTU-CVE-2026-50526Not reported
Ubuntudotnet10deb26.0410.0.110-10.0.10-0ubuntu1~26.04.1Not reportedUBUNTU-CVE-2026-50526Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References