CVE-2026-70165
CVE-2026-70165 · .NET Elevation of Privilege Vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVSS 6.7 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
.net 10.0 runtime
- Versions
- ≥ 10.0.0, < 10.0.402: Affected (custom)
Update to 10.0.402
.net 11.0 runtime
- Versions
- ≥ 11.0.0, < 11.0.100-rc.2: Affected (custom)
Update to 11.0.100-rc.2
.net 9.0 runtime
- Versions
- ≥ 9.0.0, < 9.0.319, 9.0.122: Affected (custom)
Update to 9.0.319, 9.0.122
microsoft visual studio 2022 version 17.14
- Versions
- ≥ 17.14.0, < 17.14.42: Affected (custom)
Update to 17.14.42
microsoft visual studio 2026 version 18.10
- Versions
- ≥ 18.10.0, < 18.10.4: Affected (custom)
Update to 18.10.4
dotnet7 Ubuntu:22.04:LTS
- Versions
- 7.0.105-0ubuntu1~22.04.1
- 7.0.107-0ubuntu1~22.04.1
- 7.0.108-0ubuntu1~22.04.1
- 7.0.109-0ubuntu1~22.04.1
- 7.0.110-0ubuntu1~22.04.1
- 7.0.111-0ubuntu1~22.04.1
- 7.0.112-0ubuntu1~22.04.1
- 7.0.113-0ubuntu1~22.04.1
- 7.0.114-0ubuntu1~22.04.1
- 7.0.115-0ubuntu1~22.04.1
- 7.0.116-0ubuntu1~22.04.1
- 7.0.117-0ubuntu1~22.04.1
- 7.0.117-0ubuntu1~22.04.2
- 7.0.119-0ubuntu1~22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published