# CVE-2026-96231: .NET Runtime symlink following elevation of privilege

Source: https://junglewise.ai/threats/cve-2026-96231-microsoft-security-advisory-net-and-visual-studio-elevation-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-13  
License: CC BY 4.0 with a link back

CVE-2026-96231 · Severity: high · CVSS 7.8 · Published 2026-10-13

Microsoft .NET Core runtime on Linux and macOS contains a privilege escalation vulnerability in how it handles named mutexes and shared memory paths. A local attacker with low privileges can exploit symlink races and insecure global directory permissions to truncate files, modify permissions, or gain elevated system access.

Technologies: [Microsoft .NET Runtime](https://junglewise.ai/threats/technologies/net-runtime), [Microsoft.NetCore.App.Runtime.linux-arm (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-arm), [Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-arm64), [Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-musl-arm), [Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-musl-arm64), [Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-musl-x64), [Microsoft.NetCore.App.Runtime.linux-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-linux-x64), [Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-osx-arm64), [Microsoft.NetCore.App.Runtime.osx-x64 (NuGet)](https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-osx-x64). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-96231 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96231 being exploited in the wild.

**How severe is CVE-2026-96231?** High severity, with a CVSS score of 7.8, published 13 October 2026.

**Which products and versions are affected?** Microsoft .NET Runtime 8.0.0–8.0.31, 9.0.0–9.0.20, 10.0.0–10.0.12, 11.0.0-preview.1–11.0.0-rc.1; Microsoft.NetCore.App.Runtime.linux-arm (NuGet) >= 8.0.0, <= 8.0.31, ECOSYSTEM:introduced=8.0.0,fixed=8.0.32; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) >= 8.0.0, <= 8.0.31, ECOSYSTEM:introduced=8.0.0,fixed=8.0.32; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) >= 8.0.0, <= 8.0.31, ECOSYSTEM:introduced=8.0.0,fixed=8.0.32; and 5 more.

**Is there a fix for CVE-2026-96231?** Yes. Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.32 or later; Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.32 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96231 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-96231?** Check whether you run Microsoft .NET Runtime, Microsoft.NetCore.App.Runtime.linux-arm (NuGet), Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-arm --version 8.0.32
  ```

- Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-arm64 --version 8.0.32
  ```

- Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm --version 8.0.32
  ```

- Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm64 --version 8.0.32
  ```

- Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-x64 --version 8.0.32
  ```

- Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.linux-x64 --version 8.0.32
  ```

- Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.osx-arm64 --version 8.0.32
  ```

- Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 8.0.32 or later

  ```sh
  dotnet add package Microsoft.NetCore.App.Runtime.osx-x64 --version 8.0.32
  ```


## Technical details

The vulnerability exists in System.Private.CoreLib within Microsoft.NETCore.App.Runtime, where Unix named-mutex and shared-memory paths are resolved insecurely, allowing symlink race conditions and unsafe permission modifications. A local, low-privileged attacker can exploit this to follow symlinks and access or modify files outside intended boundaries. The flaw affects .NET 8.0 through 11.0 on Linux and macOS platforms across all architectures.

## Affected products

- Microsoft .NET Runtime 8.0.0–8.0.31, 9.0.0–9.0.20, 10.0.0–10.0.12, 11.0.0-preview.1–11.0.0-rc.1

## Identifiers

- CVE-2026-96231
- GHSA-2j93-m82w-73j2

## Timeline

- 2026-10-13: disclosed

## Related threats

- [.NET Core Runtime link following privilege escalation on Unix](https://junglewise.ai/threats/cve-2026-96225-microsoft-security-advisory-net-and-visual-studio-elevation-of)
- [.NET System.Runtime DateTime parsing out-of-bounds read](https://junglewise.ai/threats/cve-2026-96233-microsoft-security-advisory-net-and-visual-studio-denial-of)
- [.NET TLS client certificate verification bypass](https://junglewise.ai/threats/cve-2026-70194-microsoft-security-advisory-net-and-visual-studio-security)
- [Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-69651-microsoft-security-advisory-net-and-visual-studio-denial-of)
- [Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.](https://junglewise.ai/threats/cve-2026-66822-microsoft-security-advisory-net-and-visual-studio-information)