Microsoft Net vulnerabilities
110 known vulnerabilities affecting microsoft/net.
Total CVEs
110
CISA KEV
2
actively exploited
Public exploits
1
Exploited in wild
3
Severity breakdown
CRITICAL4HIGH85MEDIUM21
Vulnerabilities
Page 3 of 6
CVE-2025-21172P3HIGHCVSS 7.5v8.0.0v9.0.02025-01-14
CVE-2025-21172 [HIGH] CWE-122 CVE-2025-21172: .NET and Visual Studio Remote Code Execution Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
nvd
CVE-2026-62871P3HIGHCVSS 7.8≥ 8.0.0, < 8.0.30≥ 9.0.0, < 9.0.19+1 more2026-08-11
CVE-2026-62871 [HIGH] CWE-122 CVE-2026-62871: Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-47302P3HIGHCVSS 7.5≥ 8.0.0, < 8.0.29≥ 9.0.0, < 9.0.18+1 more2026-07-14
CVE-2026-47302 [HIGH] CWE-770 CVE-2026-47302: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-50648P3HIGHCVSS 7.5≥ 8.0.0, < 8.0.29≥ 9.0.0, < 9.0.18+1 more2026-07-14
CVE-2026-50648 [HIGH] CWE-770 CVE-2026-50648: Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attack
Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-50525P3HIGHCVSS 7.5≥ 8.0.0, < 8.0.29≥ 9.0.0, < 9.0.18+1 more2026-07-14
CVE-2026-50525 [HIGH] CWE-770 CVE-2026-50525: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-50651P3HIGHCVSS 7.5≥ 8.0.0, < 8.0.29≥ 9.0.0, < 9.0.18+1 more2026-07-14
CVE-2026-50651 [HIGH] CWE-770 CVE-2026-50651: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-45490P3HIGHCVSS 7.8≥ 8.0.0, < 8.0.28≥ 9.0.0, < 9.0.17+1 more2026-06-09
CVE-2026-45490 [HIGH] CWE-285 CVE-2026-45490: Improper authorization in .NET allows an authorized attacker to elevate privileges locally.
Improper authorization in .NET allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-96959P3HIGHCVSS 7.5≥ 8.0.0, < 8.0.5≥ 9.0.0, < 9.0.21+9 more2026-10-13
CVE-2026-96959 [HIGH] CWE-770 CVE-2026-96959: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-32177P3HIGHCVSS 7.3≥ 8.0.0, < 8.0.27≥ 9.0.0, < 9.0.16+1 more2026-05-12
CVE-2026-32177 [HIGH] CWE-20 CVE-2026-32177: Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
nvd
CVE-2025-26646P3HIGHCVSS 8.0≥ 9.0.0, < 9.0.5≥ 8.0.0, < 8.0.162025-05-13
CVE-2025-26646 [HIGH] CWE-73 CVE-2025-26646: External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allo
External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-62886P3HIGHCVSS 7.8≥ 8.0.0, < 8.0.30≥ 9.0.0, < 9.0.19+1 more2026-08-11
CVE-2026-62886 [HIGH] CWE-122 CVE-2026-62886: Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
nvd
CVE-2026-58641P3HIGHCVSS 7.8≥ 8.0.0, < 8.0.30≥ 9.0.0, < 9.0.19+1 more2026-08-11
CVE-2026-58641 [HIGH] CWE-190 CVE-2026-58641: Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
nvd
CVE-2026-50650P3HIGHCVSS 7.8≥ 8.0.0, < 8.0.29≥ 9.0.0, < 9.0.182026-07-14
CVE-2026-50650 [HIGH] CWE-94 CVE-2026-50650: Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized a
Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.
nvd
CVE-2026-26131P3HIGHCVSS 7.8≥ 10.0.0, < 10.0.42026-03-10
CVE-2026-26131 [HIGH] CWE-276 CVE-2026-26131: Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-62909P3HIGHCVSS 7.8≥ 8.0.0, < 8.0.30≥ 9.0.0, < 9.0.19+1 more2026-08-11
CVE-2026-62909 [HIGH] CWE-252 CVE-2026-62909: Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.
Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-30399P3HIGHCVSS 7.5≥ 9.0.0, < 9.0.6≥ 8.0.0, < 8.0.172025-06-13
CVE-2025-30399 [HIGH] CWE-426 CVE-2025-30399: Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over
Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-35433P3HIGHCVSS 7.3≥ 8.0.0, < 8.0.27≥ 9.0.0, < 9.0.16+1 more2026-05-12
CVE-2026-35433 [HIGH] CWE-20 CVE-2026-35433: Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
nvd
CVE-2023-28260P3HIGHCVSS 7.8≥ 6.0.0, < 6.0.16≥ 7.0.0, < 7.0.52023-04-11
CVE-2023-28260 [HIGH] CVE-2023-28260: .NET DLL Hijacking Remote Code Execution Vulnerability
.NET DLL Hijacking Remote Code Execution Vulnerability
nvd
CVE-2023-35390P3HIGHCVSS 7.8≥ 6.0.0, < 6.0.21≥ 7.0.0, < 7.0.102023-08-08
CVE-2023-35390 [HIGH] CWE-77 CVE-2023-35390: .NET and Visual Studio Remote Code Execution Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
nvd
CVE-2026-50659P3MEDIUMCVSS 6.5≥ 8.0.0, < 8.0.29≥ 9.0.0, < 9.0.18+1 more2026-07-14
CVE-2026-50659 [MEDIUM] CWE-116 CVE-2026-50659: Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing ov
Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
nvd