CVE-2026-96231: .NET Runtime symlink following elevation of privilege

CVE-2026-96231 · Severity: high · CVSS 7.8 · Published 2026-10-13

Microsoft .NET Core runtime on Linux and macOS contains a privilege escalation vulnerability in how it handles named mutexes and shared memory paths. A local attacker with low privileges can exploit symlink races and insecure global directory permissions to truncate files, modify permissions, or gain elevated system access.

Technologies: Microsoft .NET Runtime, Microsoft.NetCore.App.Runtime.linux-arm (NuGet), Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet), Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet), Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet), Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet), Microsoft.NetCore.App.Runtime.linux-x64 (NuGet), Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet), Microsoft.NetCore.App.Runtime.osx-x64 (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-96231 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-96231 being exploited in the wild.
How severe is CVE-2026-96231?
High severity, with a CVSS score of 7.8, published 13 October 2026.
Which products and versions are affected?
Microsoft .NET Runtime 8.0.0–8.0.31, 9.0.0–9.0.20, 10.0.0–10.0.12, 11.0.0-preview.1–11.0.0-rc.1; Microsoft.NetCore.App.Runtime.linux-arm (NuGet) >= 8.0.0, <= 8.0.31, ECOSYSTEM:introduced=8.0.0,fixed=8.0.32; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) >= 8.0.0, <= 8.0.31, ECOSYSTEM:introduced=8.0.0,fixed=8.0.32; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) >= 8.0.0, <= 8.0.31, ECOSYSTEM:introduced=8.0.0,fixed=8.0.32; and 5 more.
Is there a fix for CVE-2026-96231?
Yes. Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.32 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96231 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-96231?
Check whether you run Microsoft .NET Runtime, Microsoft.NetCore.App.Runtime.linux-arm (NuGet), Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-arm --version 8.0.32
  • Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-arm64 --version 8.0.32
  • Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm --version 8.0.32
  • Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm64 --version 8.0.32
  • Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-x64 --version 8.0.32
  • Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-x64 --version 8.0.32
  • Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.NetCore.App.Runtime.osx-arm64 --version 8.0.32
  • Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.32 or later
    dotnet add package Microsoft.NetCore.App.Runtime.osx-x64 --version 8.0.32

Technical details

The vulnerability exists in System.Private.CoreLib within Microsoft.NETCore.App.Runtime, where Unix named-mutex and shared-memory paths are resolved insecurely, allowing symlink race conditions and unsafe permission modifications. A local, low-privileged attacker can exploit this to follow symlinks and access or modify files outside intended boundaries. The flaw affects .NET 8.0 through 11.0 on Linux and macOS platforms across all architectures.

Affected products

  • Microsoft .NET Runtime 8.0.0–8.0.31, 9.0.0–9.0.20, 10.0.0–10.0.12, 11.0.0-preview.1–11.0.0-rc.1

Identifiers

  • CVE-2026-96231
  • GHSA-2j93-m82w-73j2

Timeline

  • 2026-10-13: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.