MICROSOFT.ASPNETCORE.APP.RUNTIME.WIN-ARM64 · GHSA-95x6-7hq8-2c37 · Package
NO FIX YET
A race condition in ASP.NET Core lets an authorized local user gain higher privileges on the machine. This advisory is withdrawn as a duplicate of GHSA-7phj-vgxq-r67h, so the live record is that one.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Machines running ASP.NET Core 8 on Windows ARM64 where a user already has a local account. The withdrawn advisory does not state a fixed version, so check GHSA-7phj-vgxq-r67h for the current range and fix. Systems on other platforms or versions outside the listed range are not covered by this record.
Not affected if no-local-untrusted-users, other-platform, version-outside-range
Who cares arm64, aspnet-core, dotnet, windows
Microsoft.AspNetCore.App.Runtime.win-arm64 package version in the project file or lockfile.No fix yet, per the sources.
This advisory has been withdrawn because it is a duplicate of GHSA-7phj-vgxq-r67h. This link is maintained to preserve external references.
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.
This page as .md · .json · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.