Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-32177: .NET can let local users gain higher privileges

CVE-2026-32177 · published 5 months ago

Summary

The .NET runtime and related development tools on Windows have a coding mistake that can let someone who already has access to a computer run code with higher system rights. This could let an attacker install software, view confidential data, or change system settings. Install the latest updates from Microsoft and the respective Linux package providers to fix the issue.

What to do

Update bellsoft dotnet8-runtime to version 8.0.27-r0.
Update dotnet-sdk to version 10.0.8.
Update dotnet to version 10.0.8.
Update microsoft visual_studio_2026 to version 18.5.3 or later.
Update microsoft .net 10.0 to version 10.0.8 or later.
Update microsoft .net 8.0 to version 8.0.27 or later.
Update microsoft .net 9.0 to version 9.0.16 or later.
Update microsoft microsoft .net framework 3.5 to version 4.8.9334.0 and 4.8.4802.0 or later.
Update microsoft microsoft .net framework 3.5 and 4.7.2 to version 4.8.9334.0 and 4.8.4802.0 or later.
Update microsoft microsoft .net framework 3.5 and 4.8 to version 4.8.9334.0 and 4.8.4802.0 or later.
Update microsoft microsoft .net framework 3.5 and 4.8.1 to version 4.8.9334.0 and 4.8.4802.0 or later.
Update microsoft microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2 to version 4.8.9334.0 and 4.8.4802.0 or later.
Update microsoft microsoft .net framework 4.8 to version 4.8.9334.0 and 4.8.4802.0 or later.
Update microsoft microsoft visual studio 2022 version 17.12 to version 17.12.20 or later.
Update microsoft microsoft visual studio 2022 version 17.14 to version 17.14.32 or later.
Update microsoft microsoft visual studio 2026 version 18.5 to version 18.5.3 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:22.04:LTS	canonical	dotnet7	All versions
Alpaquita:25	bellsoft	dotnet8-runtime	>= 8.0.17-r0, < 8.0.27-r0 Fix: upgrade to 8.0.27-r0
Alpaquita:stream	bellsoft	dotnet8-runtime	>= 8.0.11-r1, < 8.0.27-r0 Fix: upgrade to 8.0.27-r0
–	microsoft	visual_studio_2022	>= 17.12.0, < 17.12.20 >= 17.14.0, < 17.14.32 `cpe:2.3:a:microsoft:visual_studio_2022::::::-::*`
–	microsoft	visual_studio_2026	>= 18.5.0, < 18.5.3 `cpe:2.3:a:microsoft:visual_studio_2026::::::::`
–	microsoft	.net_framework	4.8 4.6.2 4.7 4.7.1 4.7.2 3.5 4.8.1 `cpe:2.3:a:microsoft:.net_framework:4.8:::::::*`
–	microsoft	.net	>= 8.0.0, < 8.0.27 >= 9.0.0, < 9.0.16 >= 10.0.0, < 10.0.8 `cpe:2.3:a:microsoft:.net::::::::`
Bitnami	–	dotnet-sdk	>= 10.0.0, < 10.0.8 Fix: upgrade to 10.0.8
Bitnami	–	dotnet	>= 10.0.0, < 10.0.8 Fix: upgrade to 10.0.8
–	microsoft	.net 10.0	< 10.0.8
–	microsoft	.net 8.0	< 8.0.27
–	microsoft	.net 9.0	< 9.0.16
–	microsoft	microsoft .net framework 3.5	< 4.8.9334.0 and 4.8.4802.0
–	microsoft	microsoft .net framework 3.5 and 4.7.2	< 4.8.9334.0 and 4.8.4802.0
–	microsoft	microsoft .net framework 3.5 and 4.8	< 4.8.9334.0 and 4.8.4802.0
–	microsoft	microsoft .net framework 3.5 and 4.8.1	< 4.8.9334.0 and 4.8.4802.0
–	microsoft	microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2	< 4.8.9334.0 and 4.8.4802.0
–	microsoft	microsoft .net framework 4.8	< 4.8.9334.0 and 4.8.4802.0
–	microsoft	microsoft visual studio 2022 version 17.12	< 17.12.20
–	microsoft	microsoft visual studio 2022 version 17.14	< 17.14.32
–	microsoft	microsoft visual studio 2026 version 18.5	< 18.5.3

Original advisory text

.NET Elevation of Privilege Vulnerability

Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.

References

https://docs.bell-sw.com/security/cves/CVE-2026-32177 Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2026-32177 Third Party Advisory
https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-may-2026-servi... Third Party Advisory
https://github.com/dotnet/announcements/issues/399 Third Party Advisory
https://ubuntu.com/security/CVE-2026-32177 Third Party Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32177 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-32177 URL
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32177.json
https://access.redhat.com/security/cve/CVE-2026-32177
https://bugzilla.redhat.com/show_bug.cgi?id=2476664

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

CWE-122Heap-based Buffer Overflow

CWE-787Out-of-bounds Write

Timeline

Published12 May 2026

Updated4 Nov 2026

First seen13 May 2026

Sources

BELL-CVE-2026-32177 · OSV

UBUNTU-CVE-2026-32177 · OSV

CVE-2026-32177 · NVD

BIT-dotnet-2026-32177 · OSV

CVE-2026-32177 · MITRE

BIT-dotnet-sdk-2026-32177 · OSV

Track software like this

Free during beta