UBUNTU-CVE-2026-105544: High severity ubuntu/dotnet6 vulnerability
The VSTest artifact postprocessor can consume a forged executionComplete.json from another local user and execute attacker-controlled output handling.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/dotnet8to a version that resolves this vulnerability.Fixed in 8.0.134-8.0.34-0ubuntu1~22.04.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.115-10.0.15-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/dotnet8to a version that resolves this vulnerability.Fixed in 8.0.134-8.0.34-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.115-10.0.15-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/dotnet11to a version that resolves this vulnerability.Fixed in 11.0.100-11.0.0-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.115-10.0.15-0ubuntu1~26.04.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the affected Ubuntu .NET packages are exposed when the VSTest artifact postprocessor is used. Exploitation involves a forged executionComplete.json supplied by a different local user.
What access and conditions does an attacker need?
The attacker needs local access and low privileges, and must be able to provide a forged executionComplete.json. User interaction is also required, and exploitation has high attack complexity.
What is the impact if exploitation succeeds?
Successful exploitation can cause attacker-controlled output handling to be executed. The listed impact includes high confidentiality, integrity, and availability effects, with scope changed.