Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
Fix
Microsoft's update · Important
- KB5130036 — .NET 10.0 runtime installed on Windows, .NET 10.0 runtime installed on Mac OS, .NET 10.0 runtime installed on Linux · build 10.0.402
- Release Notes — .NET 11.0 runtime installed on Windows, .NET 11.0 runtime installed on Linux, .NET 11.0 runtime installed on Mac OS · build 11.0.100-rc.2
- Release Notes — Microsoft Visual Studio 2026 version 18.10 · build 18.10.4 · restart required
- Release Notes — Microsoft Visual Studio 2022 version 17.14 · build 17.14.42 · restart required
From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-28 · Exploitation Less Likely.
Patch, vendor advisory and mitigation references on NVD 1
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 3
- Cpes+11 CPE criteria (now 11)NVD modified 2026-10-16 19:32
- StatusUndergoing Analysis → AnalyzedNVD modified 2026-10-16 19:32
- First seenCVSS 8.8NVD modified 2026-10-14 04:19
Affected (CPE criteria) 11
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:*cpe:2.3:a:microsoft:.net:11.0.0:rc1:*:*:*:*:*:*cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:-:*:*cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:-:*:*