{"id":"EUVD-2026-29634","enisaUuid":"28be6463-4674-3819-bbd8-8227ffbd01d4","description":"Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.","datePublished":"May 12, 2026, 4:58:34 PM","dateUpdated":"Aug 10, 2026, 3:14:00 PM","baseScore":7.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C","references":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35433\n","aliases":"CVE-2026-35433\nGHSA-8x9c-mqxv-q2pp\n","assigner":"microsoft","epss":0.77,"enisaIdProduct":[{"id":"2512dc4c-47e8-3504-a207-31cecb70dfb1","product":{"name":".NET 10.0","vendor":{"name":"Microsoft"}},"product_version":"10.0.0 \u003c10.0.8"},{"id":"27d84e56-e5a4-3d7b-b314-0b0e887c7662","product":{"name":"Microsoft .NET Framework 4.8","vendor":{"name":"Microsoft"}},"product_version":"4.8.0 \u003c4.8.9334.0 and 4.8.4802.0"},{"id":"46583d37-eaae-34d2-9f0c-e7730ca6047f","product":{"name":"Microsoft .NET Framework 3.5","vendor":{"name":"Microsoft"}},"product_version":"3.5.0 \u003c4.8.9334.0 and 4.8.4802.0"},{"id":"b59d6d56-3f43-3155-a53b-19f19353af15","product":{"name":".NET 8.0","vendor":{"name":"Microsoft"}},"product_version":"8.0.0 \u003c8.0.27"},{"id":"bacf3f97-67b4-3ef5-b348-283c24d33fef","product":{"name":"Microsoft .NET Framework 3.5 AND 4.7.2","vendor":{"name":"Microsoft"}},"product_version":"4.7.0 \u003c4.8.9334.0 and 4.8.4802.0"},{"id":"c2fbb1d5-6a08-34d7-ad55-2cc8e63f9be9","product":{"name":"Microsoft .NET Framework 3.5 AND 4.8","vendor":{"name":"Microsoft"}},"product_version":"4.8.0 \u003c4.8.9334.0 and 4.8.4802.0"},{"id":"ceb94196-bbb8-302b-a0e9-87195c042280","product":{"name":".NET 9.0","vendor":{"name":"Microsoft"}},"product_version":"9.0.0 \u003c9.0.16"},{"id":"ede841b1-f15a-308c-ace1-c95bec16aaf4","product":{"name":"Microsoft .NET Framework 3.5 AND 4.8.1","vendor":{"name":"Microsoft"}},"product_version":"4.8.1 \u003c4.8.9334.0 and 4.8.4802.0"}],"enisaIdVendor":[{"id":"7e9f4893-281a-315b-8d41-140313fa856e","vendor":{"name":"Microsoft"}}],"enisaIdVulnerability":[{"id":"0e607214-fbe6-3e7c-a18a-96cbc1c518c6","vulnerability":{"id":"GHSA-8x9c-mqxv-q2pp","description":"Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability ","datePublished":"May 18, 2026, 7:20:19 PM","dateUpdated":"Jul 8, 2026, 5:41:38 PM","baseScore":0.0,"references":"https://github.com/dotnet/wpf/security/advisories/GHSA-8x9c-mqxv-q2pp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35433\nhttps://github.com/dotnet/announcements/issues/398\nhttps://access.redhat.com/security/cve/CVE-2026-35433\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2476577\nhttps://github.com/dotnet/wpf\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35433\nhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35433.json\n","enisa_id":"EUVD-2026-29634\n","aliases":"CVE-2026-35433\nGHSA-8x9c-mqxv-q2pp\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d24c986d-c4a9-31ce-9648-b8c07c8b89e0","vulnerability":{"id":"CVE-2026-35433","description":"Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.","datePublished":"May 12, 2026, 4:58:34 PM","dateUpdated":"Aug 10, 2026, 3:14:00 PM","status":"PUBLISHED","baseScore":7.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C","references":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35433\n","enisa_id":"EUVD-2026-29634\n","assigner":"microsoft","epss":0.77,"dataProcessed":"Oct 30, 2026, 7:18:46 AM","vulnerabilityProduct":[{"id":"038db497-4c6c-3c79-a545-0dabda5cfb57","product":{"name":".NET 10.0","vendor":{"name":"Microsoft"}},"product_version":"10.0.0 \u003c10.0.8"},{"id":"18ada4ea-5934-363e-ba2d-f06601955650","product":{"name":"Microsoft .NET Framework 3.5","vendor":{"name":"Microsoft"}},"product_version":"3.5.0 \u003c4.8.9334.0 and 4.8.4802.0"},{"id":"5b77cdbe-1f9f-3ee2-9da5-713851682b61","product":{"name":"Microsoft .NET Framework 4.8","vendor":{"name":"Microsoft"}},"product_version":"4.8.0 \u003c4.8.9334.0 and 4.8.4802.0"},{"id":"5d88cf9f-7025-3dd2-9301-3926ede403bc","product":{"name":"Microsoft .NET Framework 3.5 AND 4.8","vendor":{"name":"Microsoft"}},"product_version":"4.8.0 \u003c4.8.9334.0 and 4.8.4802.0"},{"id":"a0f02624-2e53-3c9d-83ec-ab87c619fa0c","product":{"name":".NET 9.0","vendor":{"name":"Microsoft"}},"product_version":"9.0.0 \u003c9.0.16"},{"id":"b13f93e2-d820-3254-9258-1ce4e25ed38a","product":{"name":"Microsoft .NET Framework 3.5 AND 4.8.1","vendor":{"name":"Microsoft"}},"product_version":"4.8.1 \u003c4.8.9334.0 and 4.8.4802.0"},{"id":"c24d2e08-d6b3-34d5-9c5c-01bec1441924","product":{"name":".NET 8.0","vendor":{"name":"Microsoft"}},"product_version":"8.0.0 \u003c8.0.27"},{"id":"f91d416e-4cdf-36dc-996f-5f08e2efe688","product":{"name":"Microsoft .NET Framework 3.5 AND 4.7.2","vendor":{"name":"Microsoft"}},"product_version":"4.7.0 \u003c4.8.9334.0 and 4.8.4802.0"}],"vulnerabilityVendor":[{"id":"a3a6d861-7af7-31b9-a5ae-1e2ca360a512","vendor":{"name":"Microsoft"}}]}}],"enisaIdAdvisory":[{"id":"8962e7ae-3017-302c-9ff3-c4af087c8bbb","advisory":{"id":"NCSC-2026-0143","description":"Kwetsbaarheden verholpen in Microsoft Developer Tools","datePublished":"May 12, 2026, 5:53:17 PM","dateUpdated":"May 12, 2026, 5:53:17 PM","baseScore":0.0,"references":"","aliases":"CVE-2026-32177\nCVE-2026-35433\nCVE-2026-32175\nCVE-2026-42899\nCVE-2026-41094\nCVE-2026-41109\nCVE-2026-41610\nCVE-2026-41611\nCVE-2026-41612\nCVE-2026-41613\nCVE-2026-42826\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"008c1e40-82b6-3fec-b054-b62bf1e32e29","product":{"name":".NET 9.0 installed on Linux","vendor":{"name":"Microsoft"}}},{"id":"05557b7d-26ad-3bcc-b0a2-5398d98b0301","product":{"name":"Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)","vendor":{"name":"Microsoft"}}},{"id":"1b8f18fd-3282-3f48-865e-3da9c90d61a8","product":{"name":".NET 8.0 installed on Windows","vendor":{"name":"Microsoft"}}},{"id":"27d445b4-f4fc-3241-a94e-c0cf5aa02380","product":{"name":".NET 10.0 installed on Mac OS","vendor":{"name":"Microsoft"}}},{"id":"30951a53-292d-3537-95f0-b56acbe8e54e","product":{"name":".NET 9.0 installed on Windows","vendor":{"name":"Microsoft"}}},{"id":"39e45b6e-db37-32ce-a46b-44d35cdacec9","product":{"name":"Azure","vendor":{"name":"Microsoft"}}},{"id":"5d4255dc-b430-3c27-83e7-88f9168cc15e","product":{"name":".NET 9.0 installed on Mac OS","vendor":{"name":"Microsoft"}}},{"id":"7863653a-8b8c-3c4a-849c-e6e3ea0e5eb8","product":{"name":".NET 8.0 installed on Linux","vendor":{"name":"Microsoft"}}},{"id":"8677f938-acc6-304d-ade9-851765f8f88c","product":{"name":"Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)","vendor":{"name":"Microsoft"}}},{"id":"8802e5cd-36f1-30d2-9209-a13f659a6366","product":{"name":"Azure DevOps","vendor":{"name":"Microsoft"}}},{"id":"a6393c5c-0b1d-30ee-a3e9-f6081526c15b","product":{"name":".NET 8.0 installed on Mac OS","vendor":{"name":"Microsoft"}}},{"id":"ad28b5f2-d8dc-385c-9acd-662c352bb073","product":{"name":"Microsoft Data Formulator","vendor":{"name":"Microsoft"}}},{"id":"b0b0522a-c3bd-3186-ae1a-ba3ca21eaa71","product":{"name":"Visual Studio Code","vendor":{"name":"Microsoft"}}},{"id":"b6f50337-2752-399c-a7a6-e9b408731039","product":{"name":"Microsoft Visual Studio 2026 version 18.5","vendor":{"name":"Microsoft"}}},{"id":"be2c611e-ab0a-3b0a-89ea-54c08f7ea474","product":{"name":"Microsoft Visual Studio 2022 version 17.12","vendor":{"name":"Microsoft"}}},{"id":"d1de8794-eff7-3f6b-a2c1-fc161a592000","product":{"name":"Microsoft Visual Studio 2022 version 17.14","vendor":{"name":"Microsoft"}}},{"id":"dfa348ca-a6c6-32ba-b503-c9d02ad20076","product":{"name":".NET 10.0 installed on Linux","vendor":{"name":"Microsoft"}}}]}},{"id":"e84829e9-44da-3d33-a167-9711f4b556fd","advisory":{"id":"msrc_CVE-2026-35433","description":".NET Elevation of Privilege Vulnerability","datePublished":"May 12, 2026, 7:00:00 AM","dateUpdated":"Jun 17, 2026, 7:00:00 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35433\nhttps://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-35433.json\n","aliases":"CVE-2026-35433\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"0b751a94-9fb1-3333-b6e3-413706a75096","product":{"name":"Microsoft .NET Framework 3.5 AND 4.8","vendor":{"name":"Microsoft"}}},{"id":"11f4f00d-8dee-3d94-b642-9286dbd55c35","product":{"name":".NET 8.0 installed on Windows","vendor":{"name":"Microsoft"}}},{"id":"5ab600ad-9710-39e5-bb75-5e6d2dac546e","product":{"name":".NET 10.0 installed on Windows","vendor":{"name":"Microsoft"}}},{"id":"7979e183-f12c-36cb-8ebd-3dfc07e6db46","product":{"name":"Microsoft .NET Framework 3.5 AND 4.7.2","vendor":{"name":"Microsoft"}}},{"id":"89379d0b-b88c-3f07-a85d-0668e3aa9bc1","product":{"name":"10.0.8","vendor":{"name":"Splunk"}}},{"id":"ac9b84e4-77a8-31bd-a582-fe35675a4a75","product":{"name":"Microsoft .NET Framework 4.8","vendor":{"name":"Microsoft"}}},{"id":"bd617c2c-787c-3794-ac5a-4e290e27e717","product":{"name":"4.8.9334.0 and 4.8.4802.0"}},{"id":"d0c4863c-8e52-3e6d-b0aa-27b16bf34342","product":{"name":"Microsoft .NET Framework 3.5 AND 4.8.1","vendor":{"name":"Microsoft"}}},{"id":"e36cc572-47dc-3f3f-abb5-4e7773bfb1ed","product":{"name":"8.0.27"}},{"id":"e6cbe662-5940-380b-84c8-2ba015af954b","product":{"name":"Microsoft .NET Framework 3.5","vendor":{"name":"Microsoft"}}},{"id":"eb5d070e-0dd2-380d-b7a7-1e2ef442acae","product":{"name":".NET 9.0 installed on Windows","vendor":{"name":"Microsoft"}}},{"id":"f5d5008d-df2e-3534-8939-8a2478812b54","product":{"name":"9.0.16"}}]}}]}