# CVE-2026-96225: .NET Core Runtime link following privilege escalation on Unix

Source: https://junglewise.ai/threats/cve-2026-96225-microsoft-security-advisory-net-and-visual-studio-elevation-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-13  
License: CC BY 4.0 with a link back

CVE-2026-96225 · Severity: high · CVSS 7.8 · Published 2026-10-13

.NET Core Runtime, used to execute applications built on Microsoft's .NET framework, contains a vulnerability in how it handles named mutexes and shared memory on Linux and macOS. A local attacker with limited privileges can exploit insecure file handling to escalate their access level, potentially gaining full control of the application or system. This affects .NET applications and self-contained deployments on affected versions.

Technologies: [Microsoft.NetCore.App.Runtime.linux-arm (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-arm), [Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-arm64), [Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-musl-arm), [Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-musl-arm64), [Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-musl-x64), [Microsoft.NetCore.App.Runtime.linux-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-x64), [Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-osx-arm64), [Microsoft.NetCore.App.Runtime.osx-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-osx-x64). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-96225 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96225 being exploited in the wild.

**How severe is CVE-2026-96225?** High severity, with a CVSS score of 7.8, published 13 October 2026.

**Which products and versions are affected?** Microsoft NETCore.App.Runtime.linux-arm 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1; Microsoft NETCore.App.Runtime.linux-arm64 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1; Microsoft NETCore.App.Runtime.linux-musl-arm 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1; Microsoft NETCore.App.Runtime.linux-musl-arm64 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1; and 12 more.

**Is there a fix for CVE-2026-96225?** Yes. Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.32 or later. Until then: Update .NET SDKs and runtimes to the patched versions immediately. Self-contained applications targeting affected versions must be recompiled and redeployed to remove the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96225 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-96225?** Check whether you run Microsoft NETCore.App.Runtime.linux-arm, Microsoft NETCore.App.Runtime.linux-arm64, Microsoft NETCore.App.Runtime.linux-musl-arm or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-arm --version 8.0.32
  ```

- Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-arm64 --version 8.0.32
  ```

- Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm --version 8.0.32
  ```

- Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm64 --version 8.0.32
  ```

- Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-x64 --version 8.0.32
  ```

- Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-x64 --version 8.0.32
  ```

- Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.osx-arm64 --version 8.0.32
  ```

- Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.osx-x64 --version 8.0.32
  ```


Update .NET SDKs and runtimes to the patched versions immediately. Self-contained applications targeting affected versions must be recompiled and redeployed to remove the vulnerability.

## Technical details

The vulnerability exists in System.Private.CoreLib's Unix named-mutex and shared-memory handling, which fails to securely resolve file paths, allowing symlink race conditions and permission-based attacks. An attacker with local access and limited privileges can exploit insecure global directories, symlink races, and unsafe permission changes to truncate files, overwrite files, or escalate privileges. The flaw is a classic link-following vulnerability (CWE-59) on Unix-based systems with local attack vector and no authentication required.

## Affected products

- Microsoft NETCore.App.Runtime.linux-arm 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1
- Microsoft NETCore.App.Runtime.linux-arm64 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1
- Microsoft NETCore.App.Runtime.linux-musl-arm 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1
- Microsoft NETCore.App.Runtime.linux-musl-arm64 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1
- Microsoft NETCore.App.Runtime.linux-musl-x64 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1
- Microsoft NETCore.App.Runtime.linux-x64 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1
- Microsoft NETCore.App.Runtime.osx-arm64 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1
- Microsoft NETCore.App.Runtime.osx-x64 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1

## Identifiers

- CVE-2026-96225
- GHSA-w6wh-p4g7-mpj2

## Timeline

- 2026-10-13: disclosed

## Related threats

- [.NET Runtime symlink following elevation of privilege](https://junglewise.ai/threats/cve-2026-96231-microsoft-security-advisory-net-and-visual-studio-elevation-of)
- [.NET System.Runtime DateTime parsing out-of-bounds read](https://junglewise.ai/threats/cve-2026-96233-microsoft-security-advisory-net-and-visual-studio-denial-of)
- [.NET TLS client certificate verification bypass](https://junglewise.ai/threats/cve-2026-70194-microsoft-security-advisory-net-and-visual-studio-security)
- [Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-69651-microsoft-security-advisory-net-and-visual-studio-denial-of)
- [Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.](https://junglewise.ai/threats/cve-2026-66822-microsoft-security-advisory-net-and-visual-studio-information)