CVE-2026-108398 .NET Framework Security Feature Bypass Vulnerability
HighCVSS 8.8
EPSS 0.78%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 | >= 3.0.0.0, < 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 | 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 |
| Microsoft .NET Framework 3.5 AND 4.7.2 | >= 4.7.0, < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 | 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 |
| Microsoft .NET Framework 3.5 AND 4.8 | >= 4.8.0, < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 | 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 |
| Microsoft .NET Framework 3.5 AND 4.8.1 | >= 4.8.1, < 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 |
| Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 | >= 4.7.0, < 4.7.4150.0 | 4.7.4150.0 |
| Microsoft .NET Framework 4.8 | >= 4.8.0, < 4.8.4811.0 | 4.8.4811.0 |
| Microsoft .NET Framework 4.8.1 | >= 4.8.0.0, < 4.8.9363.0 | 4.8.9363.0 |
| Microsoft net framework | < 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 | 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 |
| Microsoft net framework | < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 | 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 |
| Microsoft net | < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 | 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 |
| Microsoft net | < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 | 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 |
| Microsoft net | < 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0 | 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0 |
| Microsoft net | < 4.7.4150.0 | 4.7.4150.0 |
| Microsoft net | < 4.8.4811.0 | 4.8.4811.0 |
| Microsoft net | < 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 |
| Microsoft net framework | < 4.8.9363.0 | 4.8.9363.0 |
| Microsoft net | < 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0 | 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0 |
References
- MSRC Security Update Guide patch vendor-advisory
- KB5126868 patch
- KB5126868 vendor-advisory
- KB5127666 patch
- KB5127666 vendor-advisory
- KB5127685 patch
- KB5127685 vendor-advisory
- KB5127683 patch
- KB5127683 vendor-advisory
- KB5127687 patch
- KB5127687 vendor-advisory
- KB5127667 patch
- KB5127667 vendor-advisory
- KB5127668 patch
- KB5127668 vendor-advisory
- KB5127684 patch
- KB5127684 vendor-advisory
- KB5127686 patch
- KB5127686 vendor-advisory
- KB5127688 patch
- KB5127688 vendor-advisory
- KB5127689 patch
- KB5127689 vendor-advisory
- KB5127690 patch
- KB5127690 vendor-advisory
- KB5127691 patch
- KB5127691 vendor-advisory
- KB5127692 patch
- KB5127692 vendor-advisory
- KB5127693 patch
- KB5127693 vendor-advisory
- KB5127694 patch
- KB5127694 vendor-advisory
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2551111 issue-tracking
- www.cve.org
- nvd.nist.gov