Microsoft .Net 9.0
20 CVEs affecting Microsoft .Net 9.0. Latest disclosed: 2026-05-12. Critical: 1, High: 17.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43498 | Critical | 9.8 | 2024-11-12 | .NET and Visual Studio Remote Code Execution Vulnerability |
CVE-2025-21176 | High | 8.8 | 2025-01-14 | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
CVE-2025-26646 | High | 8.0 | 2025-05-13 | External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a networ… |
CVE-2026-42899 | High | 7.5 | 2026-05-12 | Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-33116 | High | 7.5 | 2026-04-14 | Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network. |
CVE-2026-32203 | High | 7.5 | 2026-04-14 | Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network. |
CVE-2026-32178 | High | 7.5 | 2026-04-14 | Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-26171 | High | 7.5 | 2026-04-14 | Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-26127 | High | 7.5 | 2026-03-10 | Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-21218 | High | 7.5 | 2026-02-10 | Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-30399 | High | 7.5 | 2025-06-13 | Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2025-21172 | High | 7.5 | 2025-01-14 | .NET and Visual Studio Remote Code Execution Vulnerability |
CVE-2025-21171 | High | 7.5 | 2025-01-14 | .NET Remote Code Execution Vulnerability |
CVE-2024-43499 | High | 7.5 | 2024-11-12 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2026-35433 | High | 7.3 | 2026-05-12 | Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-32177 | High | 7.3 | 2026-05-12 | Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-55247 | High | 7.3 | 2025-10-14 | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
CVE-2025-21173 | High | 7.3 | 2025-01-14 | .NET Elevation of Privilege Vulnerability |
CVE-2025-55248 | Medium | 4.8 | 2025-10-14 | Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network. |
CVE-2026-32175 | Medium | 4.3 | 2026-05-12 | A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could wri… |