NUGET · AUGUST 2026 · EARLY WARNING

.NET Elevation of Privilege Vulnerability (CVE-2026-62886)

Q: Am I affected?

If your.NET project uses microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64, or microsoft.windowsdesktop.app.runtime.win-x86 NuGet packages in the affected version ranges, you may be affected.

Q: What should I do right now?

Upgrade to the patched versions: 10.0.11 for .NET 10 and 9.0.19 for.NET 9. Review your project dependencies and ensure they are using the patched versions.

Q: Where can I find more information?

Consult the primary sources for further details and updates: GHSA-9mrh-pw7c-9mqm, GHSA-fx4q-gjrx-2jw6, GHSA-gg8c-3338-xw2f, GHSA-jqhp-238x-qhgf, and GHSA-vg44-h755-9hw7.

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
CVSS: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Affected component: microsoft.windowsdesktop.app.runtime.win-arm64 (nuget)
Affected versions: >= 10.0.0, <= 10.0.10 or >= 9.0.0, <= 9.0.18 or >= 8.0.0, <= 8.0.29
Patched version: 10.0.11

CVE-2026-62886GHSA-JQHP-238X-QHGF

An integer overflow vulnerability in.NET could allow unauthorized attackers to elevate privileges locally. Microsoft has released patches for affected versions.

What happened

An integer overflow or wraparound vulnerability has been reported in.NET. This issue could allow an unauthorized attacker to elevate privileges locally. The vulnerability affects Microsoft.NET projects using affected package versions. The issue is under investigation and has not been exploited in the wild.

The affected components include microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64, and microsoft.windowsdesktop.app.runtime.win-x86 NuGet packages. Versions 10.0.0 to 10.0.10, 9.0.0 to 9.0.18, and 8.0.0 to 8.0.29 are reportedly affected.

What to do about it

Upgrade to the patched versions: 10.0.11 for.NET 10 and 9.0.19 for.NET 9.
Review your.NET project dependencies and ensure they are using the patched versions.
Monitor the primary sources for updates and further information.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If microsoft.windowsdesktop.app.runtime.win-arm64 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If your.NET project uses microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64, or microsoft.windowsdesktop.app.runtime.win-x86 NuGet packages in the affected version ranges, you may be affected.

What should I do right now?

Upgrade to the patched versions: 10.0.11 for .NET 10 and 9.0.19 for.NET 9. Review your project dependencies and ensure they are using the patched versions.

Where can I find more information?

Consult the primary sources for further details and updates: GHSA-9mrh-pw7c-9mqm, GHSA-fx4q-gjrx-2jw6, GHSA-gg8c-3338-xw2f, GHSA-jqhp-238x-qhgf, and GHSA-vg44-h755-9hw7.

Sources

Join the 0Day waitlist →

← Back to all threats