CVE-2026-62909 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2026-62909

CVE-2026-62909

Published:August 11, 2026

Updated:September 01, 2026

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.

Affected Packages

microsoft.netcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=9.0.0 <9.0.19

Fix Suggestion:

Update to version 9.0.19

microsoft.netcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=10.0.0 <10.0.11

Fix Suggestion:

Update to version 10.0.11

microsoft.netcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=10.0.0 <10.0.11

Fix Suggestion:

Update to version 10.0.11

microsoft.netcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=10.0.0 <10.0.11

Fix Suggestion:

Update to version 10.0.11

microsoft.netcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=9.0.0 <9.0.19

Fix Suggestion:

Update to version 9.0.19

microsoft.netcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=10.0.0 <10.0.11

Fix Suggestion:

Update to version 10.0.11

microsoft.netcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=8.0.0 <8.0.30

Fix Suggestion:

Update to version 8.0.30

microsoft.netcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=8.0.0 <8.0.30

Fix Suggestion:

Update to version 8.0.30

microsoft.netcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=9.0.0 <9.0.19

Fix Suggestion:

Update to version 9.0.19

microsoft.netcore.app.runtime.linux-musl-arm64 (NUGET):

Affected version(s) >=8.0.0 <8.0.30

Fix Suggestion:

Update to version 8.0.30

microsoft.netcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=10.0.0 <10.0.11

Fix Suggestion:

Update to version 10.0.11

microsoft.netcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=8.0.0 <8.0.30

Fix Suggestion:

Update to version 8.0.30

microsoft.netcore.app.runtime.linux-musl-x64 (NUGET):

Affected version(s) >=10.0.0 <10.0.11

Fix Suggestion:

Update to version 10.0.11

microsoft.netcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=8.0.0 <8.0.30

Fix Suggestion:

Update to version 8.0.30

microsoft.netcore.app.runtime.linux-musl-arm (NUGET):

Affected version(s) >=9.0.0 <9.0.19

Fix Suggestion:

Update to version 9.0.19

microsoft.netcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=9.0.0 <9.0.19

Fix Suggestion:

Update to version 9.0.19

microsoft.netcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=9.0.0 <9.0.19

Fix Suggestion:

Update to version 9.0.19

microsoft.netcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=8.0.0 <8.0.30

Fix Suggestion:

Update to version 8.0.30

microsoft.netcore.app.runtime.linux-arm (NUGET):

Affected version(s) >=10.0.0 <10.0.11

Fix Suggestion:

Update to version 10.0.11

microsoft.netcore.app.runtime.linux-arm64 (NUGET):

Affected version(s) >=8.0.0 <8.0.30

Fix Suggestion:

Update to version 8.0.30

microsoft.netcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=8.0.0 <8.0.30

Fix Suggestion:

Update to version 8.0.30

microsoft.netcore.app.runtime.linux-x64 (NUGET):

Affected version(s) >=9.0.0 <9.0.19

Fix Suggestion:

Update to version 9.0.19

microsoft.netcore.app.runtime.osx-arm64 (NUGET):

Affected version(s) >=9.0.0 <9.0.19

Fix Suggestion:

Update to version 9.0.19

microsoft.netcore.app.runtime.osx-x64 (NUGET):

Affected version(s) >=10.0.0 <10.0.11

Fix Suggestion:

Update to version 10.0.11

Related Resources (5)

https://github.com/dotnet/announcements/issues/429

https://github.com/dotnet/runtime

https://nvd.nist.gov/vuln/detail/CVE-2026-62909

https://github.com/dotnet/runtime/security/advisories/GHSA-9mr8-pwpw-3j2w

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62909

Do you need more information?

CVSS v4

Base Score:

8.8

Attack Vector

LOCAL

Attack Complexity

HIGH

Attack Requirements

NONE

Privileges Required

LOW

User Interaction

NONE

Vulnerable System Confidentiality

HIGH

Vulnerable System Integrity

HIGH

Vulnerable System Availability

HIGH

Subsequent System Confidentiality

HIGH

Subsequent System Integrity

HIGH

Subsequent System Availability

HIGH

CVSS v3

Base Score:

7.8

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Exploit Maturity

UNPROVEN

Weakness Type (CWE)

Uncaught Exception

Unchecked Return Value

EPSS

Base Score:

0.29