Elevation of Privilege Vulnerability in.NET: Early Warning
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
- Affected component
- microsoft.windowsdesktop.app.runtime.win-arm64 (nuget)
- Affected versions
- >= v9.0.18, <= v9.0.18 or >= v8.0.29, <= v8.0.29 or >= v11.0.0-preview.6, <= v11.0.0-preview.6 or >= v10.0.10, <= v10.0.10 or >= v9.0.17, <= v9.0.17 or >= v11.0.0-preview.5, <= v11.0.0-preview.5 or >= v10.0.9, <= v10.0.9 or >= v8.0.28, <= v8.0.28 or >= v11.0.0-preview.4, <= v11.0.0-preview.4 or >= v9.0.16, <= v9.0.16 or >= v8.0.27, <= v8.0.27 or >= v10.0.8, <= v10.0.8 or >= v10.0.7, <= v10.0.7 or >= v11.0.0-preview.3, <= v11.0.0-preview.3 or >= v10.0.6, <= v10.0.6 or >= v9.0.15, <= v9.0.15 or >= v8.0.26, <= v8.0.26 or >= v10.0.5, <= v10.0.5 or >= v9.0.14, <= v9.0.14 or >= v8.0.25, <= v8.0.25 or >= v11.0.0-preview.2, <= v11.0.0-preview.2 or >= v10.0.4, <= v10.0.4 or >= v11.0.0-preview.1, <= v11.0.0-preview.1 or >= v9.0.13, <= v9.0.13 or >= v8.0.24, <= v8.0.24 or >= v10.0.3, <= v10.0.3 or >= v9.0.12, <= v9.0.12 or >= v8.0.23, <= v8.0.23 or >= v10.0.2, <= v10.0.2 or >= v10.0.1, <= v10.0.1 or >= v9.0.11, <= v9.0.11 or >= v8.0.22, <= v8.0.22 or >= v10.0.0, <= v10.0.0
- Patched version
- 10.0.11
An integer overflow or wraparound in.NET may allow unauthorized attackers to elevate privileges locally. Microsoft.NET projects using affected versions of the Microsoft.WindowsDesktop.App.Runtime packages are reportedly at risk.
What happened
An integer overflow or wraparound vulnerability has been reported in .NET. This flaw could potentially allow an unauthorized attacker to elevate privileges locally. The affected components are Microsoft.WindowsDesktop.App.Runtime packages for win-arm64, win-x64, and win-x86. The vulnerability is tracked under CVE-2026-62886 and GHSA-JQHP-238X-QHGF.
The vulnerability affects specific version ranges of the mentioned packages. It is crucial for users to check their current versions against the affected ranges to assess their exposure. The issue is under investigation, and no exploitation in the wild has been confirmed as of yet.
What to do about it
- Review the versions of Microsoft.WindowsDesktop.App.Runtime packages in your.NET projects.
- Upgrade to the patched versions: 10.0.11 for.NET 10 and 9.0.19 for.NET 9.
- Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.
- Consider implementing additional security measures to mitigate the risk of privilege elevation attacks.
How 0Day would have caught this
microsoft.windowsdesktop.app.runtime.win-arm64 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if your.NET projects use versions of Microsoft.WindowsDesktop.App.Runtime.win-arm64, win-x64, or win-x86 within the specified affected ranges.
What should I do right now?
Immediately review and upgrade the affected packages to their respective patched versions: 10.0.11 for.NET 10 and 9.0.19 for.NET 9.
Has this vulnerability been exploited in the wild?
There is no confirmed report of this vulnerability being exploited in the wild at this time.