Live › vulnerability › CVE-2026-96233
Go to dashboardThe .NET runtime's DateTime Hebrew-number parsing can read outside its expected stack bounds, which terminates the process. An unauthenticated remote attacker who can make an app parse crafted input can crash it, causing denial of service; the advisory does not describe code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft.NETCore.App.Runtime.linux-arm | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.linux-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.linux-musl-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.linux-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.osx-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.osx-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.win-arm |
| nuget |
| >= 10.0.0, <= 10.0.12 |
| 10.0.13 |
| Microsoft.NETCore.App.Runtime.win-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.win-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.win-x86 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.linux-arm | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.linux-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.linux-musl-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.linux-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.osx-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.osx-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.win-arm | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.win-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.win-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.win-x86 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.linux-arm | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.linux-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.linux-musl-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.linux-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.osx-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.osx-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.win-arm | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.win-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.win-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.win-x86 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.linux-arm | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.linux-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.linux-musl-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.linux-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.osx-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.osx-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.win-arm | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.win-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.win-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.win-x86 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
dotnet --info and check the installed runtime version; versions 8.0.0 to 8.0.31, 9.0.0 to 9.0.20, 10.0.0 to 10.0.12, and 11.0.0-preview.1 to 11.0.0-rc.1 are affected8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2 (or later), then restart appsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Runtime. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
DateTime Hebrew-number parsing can read outside expected stack bounds and terminate the process.
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/481
Version: 3.1
Severity: High
Score: 7.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-787 (Out-of-bounds Write)
The vulnerability affects Microsoft .NET projects that use an affected package version listed below.
| Package name | Affected version | Patched version |
|---|---|---|
| Microsoft.NETCore.App.Runtime.linux-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.linux-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.linux-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.osx-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
This page as .md · .json · in your agent: get_signal("CVE-2026-96233")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
| Microsoft.NETCore.App.Runtime.osx-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.win-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.NETCore.App.Runtime.linux-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.win-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.win-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.win-x86 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.NETCore.App.Runtime.linux-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.linux-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.osx-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.osx-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.win-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.NETCore.App.Runtime.linux-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.linux-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.linux-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.osx-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.osx-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.NETCore.App.Runtime.win-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| [Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runt |