← Search CVEs

CVE-2026-96233

HIGH 7.5

Published 2026-10-13 · Last modified 2026-10-25

Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

1.0%chance of exploitation in 30 days · 62nd percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.5CVSS 3.1 · HIGH

ConfidentialityNone
IntegrityNone
AvailabilityHigh

What an attacker needs

✓Access: Reachable over the network — no local access needed
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot: 2026-10-26T13:52:32.101Z

Affected

Vendors Microsoft

Products .Net 10.0 Runtime .Net 11.0 Runtime .Net 8.0 Runtime .Net 9.0 Runtime Microsoft .Net Framework 3.5 Microsoft .Net Framework 3.5 And 4.6.2/4.7/4.7.1/4.7.2 Microsoft .Net Framework 3.5 And 4.7.2 Microsoft .Net Framework 3.5 And 4.8 Microsoft .Net Framework 3.5 And 4.8.1 Microsoft .Net Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .Net Framework 4.8 Microsoft .Net Framework 4.8.1

Weakness (CWE)

CWE-787: : Out-of-bounds Write

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

Microsoft.NETCore.App.Runtime.linux-arm NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-musl-arm NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-musl-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-musl-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-x64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.osx-arm64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.osx-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.osx-x64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-arm NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-x86 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86
ECOSYSTEM range
- Introduced version (included): 10.0.0
- Fixed boundary (excluded): 10.0.13
13 explicitly listed affected versions
10.0.0, 10.0.1, 10.0.10, 10.0.11, 10.0.12, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 10.0.12",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-arm NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-musl-arm NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-musl-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-musl-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-x64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.osx-arm64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.osx-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.osx-x64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-arm NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-x86 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86
ECOSYSTEM range
- Introduced version (included): 11.0.0-preview.1
- Fixed boundary (excluded): 11.0.0-rc.2
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 11.0.0-rc.1",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-arm NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-musl-arm NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-musl-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-musl-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-x64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.osx-arm64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.osx-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.osx-x64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-arm NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-x86 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86
ECOSYSTEM range
- Introduced version (included): 9.0.0
- Fixed boundary (excluded): 9.0.21
21 explicitly listed affected versions
9.0.0, 9.0.1, 9.0.10, 9.0.11, 9.0.12, 9.0.13, 9.0.14, 9.0.15, 9.0.16, 9.0.17, 9.0.18, 9.0.19, 9.0.2, 9.0.20, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 9.0.20",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-arm NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-musl-arm NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-musl-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-musl-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-x64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.linux-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.osx-arm64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.osx-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.osx-x64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-arm NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-arm64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-x64 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Microsoft.NETCore.App.Runtime.win-x86 NuGet

pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86
ECOSYSTEM range
- Introduced version (included): 8.0.0
- Fixed boundary (excluded): 8.0.32
31 explicitly listed affected versions
8.0.0, 8.0.1, 8.0.10, 8.0.11, 8.0.12, 8.0.13, 8.0.14, 8.0.15, 8.0.16, 8.0.17, 8.0.18, 8.0.19, 8.0.2, 8.0.20, 8.0.21, 8.0.22, 8.0.23, 8.0.24, 8.0.25, 8.0.26, 8.0.27, 8.0.28, 8.0.29, 8.0.3, 8.0.30, 8.0.31, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8
Additional upstream package constraints
```
{
  "database": {
    "last_known_affected_version_range": "<= 8.0.31",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-87vj-4hqv-22p9/GHSA-87vj-4hqv-22p9.json"
  }
}
```
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z

Vendor product assessments

Showing 32 of 1399 vendor product statements; 1367 omitted. Read the full vendor advisory.

aspnetcore-runtime-8.0-0:8.0.32-1.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_0?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-sdk-8.0-0:8.0.132-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_0?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
aspnetcore-targeting-pack-9.0-0:9.0.21-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_2?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-runtime-dbg-8.0-0:8.0.32-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_2?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
netstandard-targeting-pack-2.1-0:9.0.122-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_2?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-hostfxr-9.0-debuginfo-0:9.0.21-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_10?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-targeting-pack-8.0-0:8.0.32-2.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_10?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-runtime-8.0-debuginfo-0:8.0.32-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_4?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-sdk-dbg-8.0-0:8.0.132-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_6?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-hostfxr-10.0-0:10.0.13-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_8?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-sdk-aot-9.0-debuginfo-0:9.0.122-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_8?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-runtime-8.0-debuginfo-0:8.0.32-1.el10_0.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_0?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-sdk-9.0-debuginfo-0:9.0.122-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_2?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet10.0-debuginfo-0:10.0.113-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_10?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-runtime-9.0-debuginfo-0:9.0.21-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]_8?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
netstandard-targeting-pack-2.1-0:9.0.122-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

Vendor assessment for this product only.

pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
aspnetcore-runtime-10.0-0:10.0.13-1.hum1@aarch64 as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
aspnetcore-runtime-8.0-0:8.0.32-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
aspnetcore-runtime-dbg-10.0-0:10.0.13-1.hum1@s390x as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
aspnetcore-runtime-dbg-9.0-0:9.0.21-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
aspnetcore-targeting-pack-10.0-0:10.0.13-1.hum1@s390x as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
aspnetcore-targeting-pack-9.0-0:9.0.21-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-apphost-pack-10.0-0:10.0.13-1.hum1@x86_64 as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-apphost-pack-9.0-0:9.0.21-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-hostfxr-10.0-0:10.0.13-1.hum1@aarch64 as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-hostfxr-8.0-0:8.0.32-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-runtime-10.0-0:10.0.13-1.hum1@s390x as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-runtime-9.0-0:9.0.21-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-runtime-dbg-10.0-0:10.0.13-1.hum1@s390x as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-runtime-dbg-9.0-0:9.0.21-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-targeting-pack-10.0-0:10.0.13-1.hum1@x86_64 as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
dotnet-targeting-pack-9.0-0:9.0.21-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00

All CVSS metrics

HIGH 7.5 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
HIGH 7.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Patches & mitigations

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96233 vendor-advisorypatchWEBCVE record · microsoft · Updated 2026-10-25T18:47:41.032Z
NVD · CVE-2026-96233 · Updated 2026-10-22T22:19:56.170
GitHub Advisory Database · GHSA-87vj-4hqv-22p9
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z

Advisories

https://osv.dev/vulnerability/GHSA-87vj-4hqv-22p9 ADVISORYGitHub Advisory Database · GHSA-87vj-4hqv-22p9
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
https://nvd.nist.gov/vuln/detail/CVE-2026-96233 ADVISORYvendor-referenceGitHub Advisory Database · GHSA-87vj-4hqv-22p9
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
Red Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-96233.json vendor-advisoryRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100203 ADVISORYEUVD · EUVD-2026-100203

Technical & other

https://github.com/dotnet/runtime/security/advisories/GHSA-87vj-4hqv-22p9 WEBGitHub Advisory Database · GHSA-87vj-4hqv-22p9
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
https://github.com/dotnet/announcements/issues/481 WEBGitHub Advisory Database · GHSA-87vj-4hqv-22p9
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
https://github.com/dotnet/runtime/issues/135708 WEBGitHub Advisory Database · GHSA-87vj-4hqv-22p9
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
https://github.com/dotnet/runtime PACKAGEGitHub Advisory Database · GHSA-87vj-4hqv-22p9
GitHub Advisory Database · GHSA-87vj-4hqv-22p9 · Updated 2026-10-19T19:30:37.819928262Z
https://access.redhat.com/security/cve/CVE-2026-96233 vendor-referenceRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://bugzilla.redhat.com/show_bug.cgi?id=2548806 vendor-referenceRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://www.cve.org/CVERecord?id=CVE-2026-96233 vendor-referenceRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:88474 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:86172 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:86168 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:86170 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:86594 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:88425 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:88422 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:86193 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:86171 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:86192 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:84424 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:88424 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:86195 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:86169 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:84491 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00
https://access.redhat.com/errata/RHSA-2026:84693 vendor-remediationRed Hat · CVE-2026-96233 · Updated 2026-10-23T04:24:57+00:00

Sources: NVD · CVE.org · EPSS