Summary
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.
New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.106 and .NET Runtime 9.0.5.Security Fix(es):
* dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | aspnetcore-runtime-9.0 | 9.0.5-1.el10_0 |
| AlmaLinux · 10 | aspnetcore-runtime-dbg-9.0 | 9.0.5-1.el10_0 |
| AlmaLinux · 10 | aspnetcore-targeting-pack-9.0 | 9.0.5-1.el10_0 |
| AlmaLinux · 10 | dotnet-apphost-pack-9.0 | 9.0.5-1.el10_0 |
| AlmaLinux · 10 | dotnet-host | 9.0.5-1.el10_0 |
| AlmaLinux · 10 | dotnet-hostfxr-9.0 | 9.0.5-1.el10_0 |
| AlmaLinux · 10 | dotnet-runtime-9.0 | 9.0.5-1.el10_0 |
| AlmaLinux · 10 | dotnet-runtime-dbg-9.0 | 9.0.5-1.el10_0 |
| AlmaLinux · 10 | dotnet-sdk-9.0 | 9.0.106-1.el10_0 |
| AlmaLinux · 10 | dotnet-sdk-9.0-source-built-artifacts | 9.0.106-1.el10_0 |
| AlmaLinux · 10 | dotnet-sdk-aot-9.0 | 9.0.106-1.el10_0 |
| AlmaLinux · 10 | dotnet-sdk-dbg-9.0 | 9.0.106-1.el10_0 |
| AlmaLinux · 10 | dotnet-targeting-pack-9.0 | 9.0.5-1.el10_0 |
| AlmaLinux · 10 | dotnet-templates-9.0 | 9.0.106-1.el10_0 |
| AlmaLinux · 10 | netstandard-targeting-pack-2.1 | 9.0.106-1.el10_0 |
Vulnerabilities 1
-
High 8.0
.NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability
External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.