Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.

Azure DevOps Server Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.

Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.

Azure Managed Grafana Elevation of Privilege Vulnerability

Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in Aspire. This advisory provides guidance on updating affected applications and components.

Aspire Dashboard's unauthenticated NotFound route can permit telemetry deletion in both standalone and AppHost-hosted deployments. In standalone deployments using browser-token authentication, it can also expose the browser token.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/526

CVSS Details

- Version: 3.1 - Severity: Critical - Score: 9.1 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness: CWE-862

Affected Platforms

- Platforms: Any supported OS - Architectures: x64, Arm64

<a name="affected-packages"></a>Affected Packages

Standalone Aspire Dashboard

Package | Affected version | Patched version --- | --- | --- Aspire Dashboard | < 13.6.5 | 13.6.5

Both 13.6.3 and 13.6.4 contain the unauthenticated NotFound route.

Aspire Dashboard SDK packages

Package | Affected version | Patched version --- | --- | --- Aspire.Dashboard.Sdk.linux-x64 | < 13.6.5 | 13.6.5 Aspire.Dashboard.Sdk.linux-arm64 | < 13.6.5 | 13.6.5 Aspire.Dashboard.Sdk.linux-musl-x64 | < 13.6.5 | 13.6.5 Aspire.Dashboard.Sdk.osx-x64 | < 13.6.5 | 13.6.5 Aspire.Dashboard.Sdk.osx-arm64 | < 13.6.5 | 13.6.5 Aspire.Dashboard.Sdk.win-x64 | < 13.6.5 | 13.6.5 Aspire.Dashboard.Sdk.win-arm64 | < 13.6.5 | 13.6.5

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Aspire Dashboard releases through 13.6.4 are affected, whether deployed independently or launched by an Aspire AppHost. For an AppHost using Dashboard SDK packages, check the resolved Aspire.Dashboard.Sdk package versions against the affected ranges above. If the AppHost selects a CLI-bundled Dashboard or a custom Dashboard path, check the version of that Dashboard instead. Aspire ships independently of .NET; installing a .NET runtime or SDK update does not replace the Dashboard.

<a name="how-fix"></a>How do I fix the issue?

Update Aspire Dashboard to version 13.6.5 or later. Neither 13.6.3 nor 13.6.4 is a fixed upgrade target.

For container deployments, explicitly set the Dashboard image to mcr.microsoft.com/aspire/dashboard:13.6.5 and recreate or redeploy the container. Replace older version tags and nightly image references, including those in generated Docker Compose or Kubernetes manifests, with this fixed stable image. Updating AppHost package references alone does not replace an image reference in an existing deployment manifest.

For an AppHost using Dashboard SDK packages, update any explicit Aspire.Hosting.AppHost version, including a central package version, to 13.6.5 or later. If that reference is supplied implicitly by Aspire.AppHost.Sdk, update the SDK reference to 13.6.5 or later instead. Restore and rebuild the AppHost, verify that its resolved Aspire.Dashboard.Sdk packages are 13.6.5 or later, and restart the AppHost to run the updated Dashboard.

If your AppHost selects a CLI-bundled Dashboard or a custom Dashboard path, update the Dashboard in that selected bundle or location to 13.6.5 or later and restart the AppHost. Updating AppHost package references alone does not replace that Dashboard.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue in the Aspire repository at https://github.com/microsoft/aspire. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-118740

Acknowledgements

- Weeraphat Srisutham

Revisions

V1.0 (November 10, 2026): Advisory published.

Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Azure OpenAI Elevation of Privilege Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Authentication bypass using an alternate path or channel in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.

Release of invalid pointer or reference in Windows iSCSI allows an unauthorized attacker to execute code over a network.

Double free in Windows DNS allows an unauthorized attacker to execute code over a network.

Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Microsoft DirectMusic Remote Code Execution Vulnerability

Double free in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.

Use after free in Windows Virtual Filtering Platform (VFP) allows an unauthorized attacker to execute code over a network.

Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.

SignalR connections are not consistently bound to the identity negotiated at connection establishment, allowing injected messages to execute Hub invocations as the victim.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/504

CVSS Details

- Version: 3.1 - Severity: Critical - Score: 9.0 (base score) - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-863

Affected Platforms

- Platforms: Windows, Linux, macOS - Architectures: All

<a name="affected-packages"></a>Affected Packages

The tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.

ASP.NET Core 2.3 - standalone packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.Http.Connections | >= 1.2.0, <= 1.2.13 | 1.2.14

.NET 8.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34

.NET 9.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23

.NET 10.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Check the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.

<a name="how-fix"></a>How do I fix the issue?

Install the applicable runtime or update each independently referenced package to the fixed version above. After updating standalone packages, rebuild and redeploy affected applications, including framework-dependent applications; restarting alone does not replace app-local packages. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114146

Acknowledgements

- Mika Vehns with MIVE GmbH - Lucas Gabriel - hsuan0223x - Mariusz Maik - Pocas (Jeongwon Jo) - Grace Chapel - Jacob Keith with Keith Systems - Weeraphat Srisutham - Kevin Gosse - Artur Stetsko - Yudai Shibata - 71C4 - Attila Csatadi of ZeroDayBugs.com - Vu Van Tien ( @n0Be3r )

Revisions

V1.0 (November 10, 2026): Advisory published.

Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.

Chromium CVE-2026-121076: Use after free

In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AFVSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.

In the Linux kernel, the following vulnerability has been resolved:

wifi: p54: validate firmware record lengths

The p54 firmware parser accesses component ID and component version records without checking that their lengths cover the fields being read. A malformed record can therefore make the parser read past the record.

Validate the component ID and component version record lengths before accessing their data. The descriptor record is also checked against the shortest descriptor length found in the supported firmware images.

Reject descriptor values that underflow the RX offset or produce an empty RX range before updating the driver state.

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi: Validate the ITT reflected in a Reject PDU

A Reject PDU carries a copy of the header it rejects, and iscsihandlereject() takes the ITT out of that copy to find the task to clean up:

memcpy(&rejectedpdu, data, sizeof(struct iscsihdr)); ... task = iscsiitttotask(conn, rejectedpdu.itt);

That value is whatever the target put there. iscsiitttotask() bounds the index against cmdsmax and checks nothing else, so any task in the pool can be named, and iscsinopoutrsp() then completes it.

An index that has never been used gives a NULL task->conn: the pool is zeroed at session setup and conn is assigned only when a task is allocated. If the task was used and returned, iscsicompletetask() hits its WARNONONCE(task->state == ISCSITASKFREE) and the refcount underflows. An in-flight SCSI command is completed as successful - a 1 MiB read returned 1048576 with none of its buffer written and no warning.

Validate the reflected ITT the way iscsiitttoctask() validates a command ITT, and require the task to be in flight and not a SCSI command.

[ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, archcaps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.251616] RIP: 0010:iscsinopoutrsp.constprop.0+0x46/0x160 [ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206 [ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25 [ 6.253345] RDX: 000000000000000c RSI: ffff88806c907c38 RDI: 0000000000000060 [ 6.253642] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff235a504 [ 6.253947] R10: 0000000000000003 R11: 7463656e6e6f6320 R12: 0000000000000000 [ 6.254251] R13: 0000000000000000 R14: ffff88806c907c38 R15: 0000000000000000 [ 6.254549] FS: 0000000000000000(0000) GS:ffff8880d95bc000(0000) knlGS:0000000000000000 [ 6.254887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.255140] CR2: 00007fc393e8ffc0 CR3: 0000000005252006 CR4: 0000000000770ef0 [ 6.255439] PKRU: 55555554 [ 6.255564] Call Trace: [ 6.255674] <IRQ> [ 6.255768] iscsicompletepdu+0x18bf/0x22a0 [ 6.256733] iscsicompletepdu+0x54/0xa0 [ 6.256905] iscsitcpdatarecvdone+0xf4/0x250 [ 6.257103] iscsitcprecvskb+0x31e/0xec0 [ 6.257680] iscsiswtcprecv+0x12f/0x390 [ 6.258061] tcpreadsock+0x1ab/0x810 [ 6.258853] iscsiswtcpdataready+0x18b/0x510 [ 6.259808] tcpdataqueue+0x1f13/0x4cd0 [ 6.260567] tcprcvestablished+0x8a5/0x3a00 [ 6.261931] tcpv4dorcv+0x449/0x960 [ 6.262269] tcpv4rcv+0x2245/0x3bc0