Live › vulnerability › CVE-2026-114148
Linux ASP.NET Core runtime and targeting-pack tarballs (and source-built .NET tarballs) carry unsafe numeric file ownership. If they are extracted so that ownership is preserved (for example as root, or in a container image import), a local user can modify runtime files that a more privileged app then uses, and gain higher privileges. It is a local attack only.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Linux hosts and container images where the ASP.NET Core runtime or targeting pack was installed from a Microsoft tar.gz (or a source-built .NET tarball) with ownership preserved, and where untrusted local accounts exist. Skip it if you are on managed hosting, if no untrusted local users can reach the machine, or if the files were extracted with --no-same-owner into an admin-owned directory.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ASP.NET Core 8 Linux tarballs | vendor | >= 8.0.0, < 8.0.33 | 8.0.33 |
| ASP.NET Core 9 Linux tarballs | vendor | >= 9.0.0, < 9.0.22 | 9.0.22 |
8.0.33 / 9.0.22 (or from a source-built .NET archive in the affected ranges)8.0.33 or 9.0.22 (source-built: 8.0.133, 9.0.123, 10.0.114-servicing.26522.126, 10.0.403-servicing.26523.112, 11.0.100-rc.3.26522.148)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
This page as .md · .json · in your agent: get_signal("CVE-2026-114148")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.