Microsoft update

KB5133965

Security Update

Fixed in

.NET 9.0 installed on Linux 9.0.320
.NET 9.0 installed on Mac OS 9.0.320
.NET 9.0 installed on Windows 9.0.320
ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published) 9.0.22

TI-2026-72269 CVE-2026-70197 · GHSA-4mpw-cpwj-hxxj

LOW 39

Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00788 Published 2026-10-13 Fixed in 10.0.403, 10.0.13 +16 CWE-787

TI-2026-82582 CVE-2026-114148

LOW 36

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00355 Published 2026-10-29 Partial fix · 10.0.403, 11.0.100-rc.3 +4 CWE-276