CVE-2026-114148

Fix

Microsoft's update · Important

• KB5133964 — .NET 8.0 installed on Windows, .NET 8.0 installed on Linux, .NET 8.0 installed on Mac OS · build 8.0.427 · restart required
• KB5133965 — .NET 9.0 installed on Windows, .NET 9.0 installed on Linux, .NET 9.0 installed on Mac OS · build 9.0.320 · restart required
• KB5133966 — .NET 10.0 installed on Windows, .NET 10.0 installed on Linux, .NET 10.0 installed on Mac OS · build 10.0.403 · restart required
• Release Notes — .NET 11.0 installed on Windows, .NET 11.0 installed on Linux, .NET 11.0 installed on Mac OS · build 11.0.100-rc.3 · restart required
• KB5133965 — ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published) · build 9.0.22 · restart required
• KB5133966 — .NET source-build Linux tarballs (all archive types) · build 10.0.403-servicing.26523.112 · restart required

From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-29 · Exploitation Less Likely.

Public exploits 1

• Ghost-Bx1/DotNet-Tarball-CVE-2026-114148 PoC on GitHub

Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.

Patch, vendor advisory and mitigation references on NVD 1

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148 vendor-advisory, patch

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.