Summary
It was discovered that .NET did not properly handle link resolution before
file access. A local attacker could use this issue to perform unauthorized
file tampering and write arbitrary files outside of the intended extraction
directory. (CVE-2026-45491)
It was discovered that .NET did not properly handle deeply-nested
MessagePack arrays. An attacker could use this to cause .NET to consume
excessive resources, resulting in a denial of service. (CVE-2026-45591)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | dotnet8 | 8.0.128-8.0.28-0ubuntu1~22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | dotnet10 | 10.0.109-10.0.9-0ubuntu1~24.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | dotnet8 | 8.0.128-8.0.28-0ubuntu1~24.04.1 |
| Ubuntu · 25.10 | dotnet10 | 10.0.109-10.0.9-0ubuntu1~25.10.1 |
| Ubuntu · 25.10 | dotnet8 | 8.0.128-8.0.28-0ubuntu1~25.10.1 |
| Ubuntu · 25.10 | dotnet9 | 9.0.118-9.0.17-0ubuntu1~25.10.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | dotnet10 | 10.0.109-10.0.9-0ubuntu1~26.04.1 |