Microsoft update

KB5133966

Security Update

Fixed in

.NET 10.0 installed on Linux 10.0.403
.NET 10.0 installed on Mac OS 10.0.403
.NET 10.0 installed on Windows 10.0.403
.NET source-build Linux tarballs (all archive types) 10.0.403-servicing.26523.112
Microsoft.AspNetCore.Components.WebAssembly.DevServer 10.0.14
Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.14

TI-2026-73322 CVE-2026-102870 · GHSA-g27p-qf6j-c96c

MEDIUM 42

Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00906 Published 2026-10-13 Fixed in 10.0.403, 11.0.100-rc.3 +8 CWE-94

TI-2026-72269 CVE-2026-70197 · GHSA-4mpw-cpwj-hxxj

LOW 39

Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00788 Published 2026-10-13 Fixed in 10.0.403, 10.0.13 +16 CWE-787

TI-2026-82582 CVE-2026-114148

LOW 36

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00355 Published 2026-10-29 Partial fix · 10.0.403, 11.0.100-rc.3 +4 CWE-276