Microsoft .Net 9.0 Installed On Windows
16 CVEs affecting Microsoft .Net 9.0 Installed On Windows. Latest disclosed: 2026-11-10. Critical: 1, High: 14.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-114146 | Critical | 9.0 | 2026-11-10 | Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
CVE-2026-118745 | High | 8.8 | 2026-11-10 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2026-114159 | High | 8.8 | 2026-11-10 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2026-114158 | High | 8.8 | 2026-11-10 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2026-114152 | High | 8.8 | 2026-11-10 | Stack-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2026-114151 | High | 8.8 | 2026-11-10 | Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2026-70197 | High | 8.1 | 2026-10-13 | Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. |
CVE-2026-70175 | High | 8.1 | 2026-10-13 | Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-114148 | High | 7.8 | 2026-10-29 | Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. |
CVE-2026-114157 | High | 7.5 | 2026-11-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges… |
CVE-2026-114154 | High | 7.5 | 2026-11-10 | Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-114149 | High | 7.5 | 2026-11-10 | Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-114147 | High | 7.5 | 2026-11-10 | Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-109478 | High | 7.5 | 2026-11-10 | Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-105544 | High | 7.5 | 2026-11-10 | Improper access control in .NET allows an authorized attacker to elevate privileges locally. |
CVE-2026-109476 | Medium | 6.1 | 2026-11-10 | Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network. |