Executive brief
A security vulnerability exists in the Microsoft .NET runtime, a framework used to build and run applications on Linux and macOS. A flaw in how the system handles internal communications could allow a local user with limited access to gain higher privileges on the machine. To resolve this, organizations must update their .NET installations and redeploy any self-contained applications built with the affected versions.
Technical details
A vulnerability classified as CWE-252 (Unchecked Return Value) exists in the .NET diagnostics Inter-Process Communication (IPC) mechanism. A missing error check during the initialization of shared resources leads to the application of an improper Access Control List (ACL). A local attacker with low privileges can exploit this flaw to achieve elevation of privilege, provided there is some level of user interaction and specific timing conditions (high complexity). The issue affects .NET 8, 9, and 10 on Linux and macOS platforms. Patches are available in versions 8.0.30, 9.0.19, and 10.0.11.
Affected products
- Microsoft .NET Runtime 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched