MICROSOFT.NETCORE.APP.RUNTIME.WIN-X86 · GHSA-mqcg-252r-5fj7 · Other
NO FIX YET
This advisory is withdrawn as a duplicate of GHSA-fpxj-5c99-g7vj. The original text says deserialization of untrusted data in Visual Studio lets an unauthorized attacker execute code over a network.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
This entry is withdrawn and points to GHSA-fpxj-5c99-g7vj for the real details. The listed product range is a NuGet runtime package for 8.0.x, which does not match the Visual Studio title, so the sources conflict. Teams should rely on the duplicate advisory.
Not affected if withdrawn-duplicate
Who cares dotnet, visual-studio, windows
Microsoft.NETCore.App.Runtime.win-x86 version range listed in this record only against the duplicate advisoryNo fix yet, per the sources.
This advisory has been withdrawn because it is a duplicate of GHSA-fpxj-5c99-g7vj. This link is maintained to preserve external references.
Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.