Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited. Customer action: Required.
Details
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.
What privileges could an attacker gain by successfully exploiting this vulnerability?
An attacker could execute code with the permissions of another user on the affected system. This could give the attacker access to data and resources available to that user.
Security updates
11.0.100 — https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md
10.0.404 — https://github.com/dotnet/sdk/releases/tag/v10.0.404
10.0.404 — https://support.microsoft.com/help/5135241
Vulnerabilities 1
-
High 7.5
.NET Elevation of Privilege Vulnerability
Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally.
Revision history
-
#2
Changes made to the security updates links and information. This is an informational change only.
-
#1
Information published.
References
-
CVE-2026-114155 .NET Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114155
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss