{"id":"GHSA-95x6-7hq8-2c37","kind":"vulnerability","aliases":["GHSA-95x6-7hq8-2c37"],"related":[],"title":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114157 - ASP.NET Core Security Feature Bypass Vulnerability","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-7phj-vgxq-r67h. This link is maintained to preserve external references.\n\n## Original Description\nConcurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.","summary":"A race condition in ASP.NET Core lets an authorized local user gain higher privileges on the machine. This advisory is withdrawn as a duplicate of GHSA-7phj-vgxq-r67h, so the live record is that one.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","fixed":[],"affected":">= 8.0.0-preview.1.23112.2, <= 8.0.33","ecosystem":"nuget"}],"ecosystems":["nuget"],"tags":["arm64","aspnet-core","cwe-362","dotnet","package","windows"],"not_affected_if":["no-local-untrusted-users","other-platform","version-outside-range"],"how_to_check":"- Check the installed `Microsoft.AspNetCore.App.Runtime.win-arm64` package version in the project file or lockfile.\n- Compare it with the affected range 8.0.0-preview.1.23112.2 to 8.0.33.","fix":null,"status":"withdrawn","published_at":"2026-11-10T21:32:52+00:00","first_seen_at":"2026-11-10T22:17:21+00:00","triaged_at":"2026-11-10T22:18:02+00:00","updated_at":"2026-11-10T22:18:02+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-10T22:18:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"ASP.NET Core: race condition lets a local user elevate privileges","impact":"high","summary":"A race condition in ASP.NET Core lets an authorized local user gain higher privileges on the machine. This advisory is withdrawn as a duplicate of GHSA-7phj-vgxq-r67h, so the live record is that one.","audience":"businesses","category":"package","nicknames":[],"who_cares":["aspnet-core","dotnet","windows","arm64"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the machine","analyst_note":"Withdrawn duplicate; confirm the fixed version and affected ranges on GHSA-7phj-vgxq-r67h, which is the live advisory.","how_to_check":"- Check the installed `Microsoft.AspNetCore.App.Runtime.win-arm64` package version in the project file or lockfile.\n- Compare it with the affected range 8.0.0-preview.1.23112.2 to 8.0.33.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users","other-platform","version-outside-range"],"who_is_affected":"Machines running ASP.NET Core 8 on Windows ARM64 where a user already has a local account. The withdrawn advisory does not state a fixed version, so check GHSA-7phj-vgxq-r67h for the current range and fix. Systems on other platforms or versions outside the listed range are not covered by this record.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000756,"input_tokens":4680,"output_tokens":576,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114157':8A '-2026':7A '-362':32B '2c37':19A,24A '7hq8':18A,23A '7phj':63B,88C '95x6':17A,22A 'advisori':2A,5A,54B,74C,76C 'allow':114C 'arm64':26A,27B 'asp.net':9A,40B,112C 'aspnet':29B 'aspnet-cor':28B 'attack':117C 'author':44B,116C 'bypass':13A 'concurr':101C 'condit':38B,110C 'core':10A,30B,41B,113C 'cve':6A 'cwe':31B 'descript':100C 'dotnet':33B 'duplic':1A,59B,73C,84C 'elev':119C 'execut':102C 'extern':97C 'featur':12A 'gain':47B 'ghsa':16A,21A,62B,87C 'ghsa-7phj-vgxq-r67h':61B,86C 'ghsa-95x6-7hq8-2c37':15A,20A 'higher':48B 'improp':107C 'let':42B 'link':92C 'live':68B 'local':45B,121C 'machin':52B 'maintain':94C 'microsoft':3A 'microsoft.aspnetcore.app.runtime.win':25A 'one':72B 'origin':99C 'packag':34B 'preserv':96C 'privileg':49B,120C 'r67h':65B,90C 'race':37B,109C 'record':69B 'refer':98C 'resourc':105C 'secur':4A,11A 'share':104C 'synchron':108C 'use':103C 'user':46B 'vgxq':64B,89C 'vulner':14A 'window':35B 'withdrawn':56B,79C","nicknames":[],"mitigations":[],"who_affected":"Machines running ASP.NET Core 8 on Windows ARM64 where a user already has a local account. The withdrawn advisory does not state a fixed version, so check GHSA-7phj-vgxq-r67h for the current range and fix. Systems on other platforms or versions outside the listed range are not covered by this record.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["microsoftaspnetcoreappruntimewinarm64"],"ptokens":["app","arm64","aspnetcore","microsoft","runtime","win"],"labels":["arm64","aspnetcore","cwe362","dotnet","high","nuget","package","windows"],"campaign_type":null,"search_a":"'-114157':8A '-2026':7A '2c37':19A,24A '7hq8':18A,23A '95x6':17A,22A 'advisori':2A,5A 'arm64':26A 'asp.net':9A 'bypass':13A 'core':10A 'cve':6A 'duplic':1A 'featur':12A 'ghsa':16A,21A 'ghsa-95x6-7hq8-2c37':15A,20A 'microsoft':3A 'microsoft.aspnetcore.app.runtime.win':25A 'secur':4A,11A 'vulner':14A","search_b":"'-362':32B '7phj':63B 'advisori':54B 'arm64':27B 'asp.net':40B 'aspnet':29B 'aspnet-cor':28B 'author':44B 'condit':38B 'core':30B,41B 'cwe':31B 'dotnet':33B 'duplic':59B 'gain':47B 'ghsa':62B 'ghsa-7phj-vgxq-r67h':61B 'higher':48B 'let':42B 'live':68B 'local':45B 'machin':52B 'one':72B 'packag':34B 'privileg':49B 'r67h':65B 'race':37B 'record':69B 'user':46B 'vgxq':64B 'window':35B 'withdrawn':56B","search_c":"'7phj':88C 'advisori':74C,76C 'allow':114C 'asp.net':112C 'attack':117C 'author':116C 'concurr':101C 'condit':110C 'core':113C 'descript':100C 'duplic':73C,84C 'elev':119C 'execut':102C 'extern':97C 'ghsa':87C 'ghsa-7phj-vgxq-r67h':86C 'improp':107C 'link':92C 'local':121C 'maintain':94C 'origin':99C 'preserv':96C 'privileg':120C 'r67h':90C 'race':109C 'refer':98C 'resourc':105C 'share':104C 'synchron':108C 'use':103C 'vgxq':89C 'withdrawn':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:32:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-95x6-7hq8-2c37","url":"https://github.com/advisories/GHSA-95x6-7hq8-2c37","severity":"high","published_at":"2026-11-10T21:32:52+00:00","modified_at":"2026-11-10T22:16:48+00:00","first_seen_at":"2026-11-10T22:17:21+00:00","fetched_at":"2026-11-10T22:22:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}