CVE-2026-50649
CVE-2026-50649 · .NET Remote Code Execution Vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.
CVSS 7.8 · High · EPSS 4.0% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
.net 8.0 runtime
- Versions
- ≥ 8.0.0, < 8.0.29: Affected (custom)
Update to 8.0.29
.net 9.0 runtime
- Versions
- ≥ 9.0.0, < 9.0.18: Affected (custom)
Update to 9.0.18
microsoft .net framework 3.5
- Versions
- ≥ 3.5.0, < 2.0.50727.9182 & 3.0.30729.9168: Affected (custom)
No fix published
microsoft .net framework 3.5 and 4.7.2
- Versions
- ≥ 4.7.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0: Affected (custom)
No fix published
microsoft .net framework 3.5 and 4.8
- Versions
- ≥ 4.8.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0: Affected (custom)
No fix published
microsoft .net framework 3.5 and 4.8.1
- Versions
- ≥ 4.8.1, < 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0: Affected (custom)
No fix published
microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2
- Versions
- ≥ 4.7.0, < 4.7.4143.0: Affected (custom)
Update to 4.7.4143.0
microsoft .net framework 4.8
- Versions
- ≥ 4.8.0, < 4.8.4803.0: Affected (custom)
Update to 4.8.4803.0
microsoft .net framework 4.8.1
- Versions
- ≥ 4.8.0.0, < 4.8.9340.0: Affected (custom)
Update to 4.8.9340.0
microsoft visual studio 2026 version 18.7
- Versions
- ≥ 18.0, < 18.7.4: Affected (custom)
Update to 18.7.4
dotnet7 Ubuntu:22.04:LTS
- Versions
- 7.0.105-0ubuntu1~22.04.1
- 7.0.107-0ubuntu1~22.04.1
- 7.0.108-0ubuntu1~22.04.1
- 7.0.109-0ubuntu1~22.04.1
- 7.0.110-0ubuntu1~22.04.1
- 7.0.111-0ubuntu1~22.04.1
- 7.0.112-0ubuntu1~22.04.1
- 7.0.113-0ubuntu1~22.04.1
- 7.0.114-0ubuntu1~22.04.1
- 7.0.115-0ubuntu1~22.04.1
- 7.0.116-0ubuntu1~22.04.1
- 7.0.117-0ubuntu1~22.04.1
- 7.0.117-0ubuntu1~22.04.2
- 7.0.119-0ubuntu1~22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published