GHSA-7q4v-2mr6-5gpxPublished

.NET Tampering Vulnerability

cve-program · CVE-2026-45491

Published

.NET 10.0 runtime

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Microsoft",
                    "product": ".NET 10.0 runtime",
                    "versions": [
                        {
                            "version": "10.0.0",
                            "lessThan": "10.0.9",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

.NET 8.0

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Microsoft",
                    "product": ".NET 8.0",
                    "versions": [
                        {
                            "version": "8.0",
                            "lessThan": "8.0.28",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

.NET 8.0 runtime

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Microsoft",
                    "product": ".NET 8.0 runtime",
                    "versions": [
                        {
                            "version": "8.0.0",
                            "lessThan": "8.0.28",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

.NET 9.0 runtime

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Microsoft",
                    "product": ".NET 9.0 runtime",
                    "versions": [
                        {
                            "version": "9.0.0",
                            "lessThan": "9.0.17",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-35675

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Jun 9, 2026, 5:04:44 PM

dateUpdated: Nov 10, 2026, 11:23:39 PM

20 related source bulletins · separate from aliases

RHSA-2026:25220: Red Hat Security Advisory: .NET 8.0 security update