Summary
Microsoft heeft kwetsbaarheden verholpen in .NET, .NET Framework, Visual Studio en PowerShell.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Denial-of-Service (DoS)
- Toegang tot gevoelige gegevens
- Omzeilen van een beveiligingsmaatregel
- Spoofing
```
.NET, .NET Framework, Visual Studio:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-33116 | 7,50 | Denial-of-Service |
|----------------|------|-------------------------------------|
Microsoft PowerShell:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-26143 | 7,80 | Omzeilen van beveiligingsmaatregel |
|----------------|------|-------------------------------------|
GitHub Copilot and Visual Studio Code:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-23653 | 5,70 | Toegang tot gevoelige gegevens |
|----------------|------|-------------------------------------|
.NET and Visual Studio:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-32203 | 7,50 | Denial-of-Service |
|----------------|------|-------------------------------------|
.NET Framework:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-32226 | 5,90 | Denial-of-Service |
| CVE-2026-23666 | 7,50 | Denial-of-Service |
|----------------|------|-------------------------------------|
.NET:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-32178 | 7,50 | Voordoen als andere gebruiker |
| CVE-2026-26171 | 7,50 | Denial-of-Service |
|----------------|------|-------------------------------------|
```
Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Vulnerabilities 8
-
High 7.8
Microsoft PowerShell Security Feature Bypass Vulnerability
Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
-
High 7.5
.NET Framework Denial of Service Vulnerability
Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Spoofing Vulnerability
Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.
-
High 7.5
.NET and Visual Studio Denial of Service Vulnerability
Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.
-
Medium 5.9
.NET Framework Denial of Service Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network.
-
Medium 5.7
GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network.
Revision history
-
#1.0.0
Initiele versie