•6 minutes ago•CVE-2026-114147
7.5CVE-2026-114147: Denial of Service via Memory Leak in ASP.NET Core SignalR Redis Backplane
CVE-2026-114147 is a high-severity Denial of Service (DoS) vulnerability affecting ASP.NET Core and specifically the Microsoft.AspNetCore.SignalR.StackExchangeRedis scale-out provider across .NET 8.0, 9.0, 10.0, and 11.0 preview releases. The vulnerability originates from a string comparison mismatch between internal per-connection group collections and the centralized Redis channel subscription registry, compounded by a race condition during connection teardown. Remote unauthenticated attackers can exploit this flaw to leave orphaned connection contexts and active Redis pub/sub listeners pinned in memory, leading to unbounded memory exhaustion and application process termination.
0 views•10 min read
•about 1 hour ago•CVE-2026-114156
6.5CVE-2026-114156: Path Equivalence Security Feature Bypass in Microsoft ASP.NET Core
CVE-2026-114156 is an improper resolution of path equivalence vulnerability (CWE-41) in Microsoft ASP.NET Core affecting .NET 11.0 preview releases and Microsoft Visual Studio 2026. The vulnerability stems from a discrepancy between how path prefix validation helpers (such as PathString.StartsWithSegments) and downstream routing mechanisms handle alternate path separators and percent-encoded characters. An unauthenticated remote attacker can exploit this mismatch over the network to bypass path-based authorization middleware and access restricted endpoints.
4 views•8 min read
•about 2 hours ago•CVE-2026-114157
7.5CVE-2026-114157: Local Privilege Escalation via Race Condition in ASP.NET Core Kestrel Named Pipes Transport
CVE-2026-114157 is a high-severity local privilege escalation and security feature bypass vulnerability affecting ASP.NET Core on Microsoft Windows. The flaw resides in the Kestrel web server's Named Pipes transport layer (Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes) and stems from a race condition (CWE-362) during broken pipe error recovery. When an active connection throws an IOException during handshake acceptance, the connection listener previously disposed of the broken NamedPipeServerStream instance before acquiring a replacement stream from its internal pool. This sequence created a momentary window where zero server instances of the named pipe existed in the Windows Named Pipe File System (NPFS). A local, low-privileged attacker can exploit this timing window to create a named pipe with the identical name and a permissive Discretionary Access Control List (DACL), hijacking subsequent inter-process communications and escalating privileges across security boundaries.
4 views•11 min read
•about 3 hours ago•CVE-2026-124194
6.5CVE-2026-124194: Forced Authentication and NetNTLMv2 Credential Leakage in Microsoft Office Outlook
CVE-2026-124194 is a forced authentication and spoofing vulnerability in Microsoft Office Outlook caused by a missing user interface warning before dereferencing remote network paths (CWE-356). By embedding an attacker-controlled Universal Naming Convention (UNC) path within MAPI message properties such as PidLidReminderFileParameter, an unauthenticated remote attacker can force a victim's system to initiate an outbound SMB or WebDAV connection upon opening or previewing a crafted message. This automatic authentication handshake leaks the user's NetNTLMv2 hash, enabling offline password cracking or real-time NTLM relay attacks. The vulnerability was exploited in the wild as a zero-day prior to its remediation in Microsoft's November 2026 Patch Tuesday updates and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
13 views•10 min read
•about 3 hours ago•CVE-2026-114154
7.5CVE-2026-114154: Denial of Service in ASP.NET Core HttpSys Request Header Processing
CVE-2026-114154 is a high-severity Denial of Service (DoS) and uncontrolled resource consumption vulnerability in the Microsoft.AspNetCore.Server.HttpSys component of ASP.NET Core. When processing an HTTP request that simultaneously contains a chunked Transfer-Encoding header, a Content-Length header, and an explicit X-Content-Length header, the server throws an unhandled ArgumentException during header normalization. In certain versions, subsequent exception handling attempts to dereference a disposed native request context, aborting error response dispatch and leaking unmanaged HTTP.sys request structures.
4 views•9 min read
•about 4 hours ago•CVE-2026-120778
7.3CVE-2026-120778: Local Elevation of Privilege via Insecure Temporary Directory Handling and MSBuild Response File Hijacking in Microsoft .NET Aspire CLI
A local elevation of privilege vulnerability exists in the Microsoft .NET Aspire CLI (`Aspire.Cli`) versions 13.5.4 prior to 13.6.5. When executing SDK management commands (`aspire sdk generate`, `aspire sdk dump`, and `aspire sdk export`), the CLI creates temporary project directories inside the shared operating system temporary folder (such as `/tmp` on Unix-like systems) without restricting directory permissions or disabling MSBuild automatic response file resolution. A local, low-privileged attacker on a multi-user system can place a crafted `Directory.Build.rsp` file in the shared temporary directory hierarchy. When a victim user executes an affected Aspire CLI command, MSBuild traverses upward, ingests the attacker-controlled response file, and executes arbitrary commands in the security context of the victim user.
4 views•10 min read
•about 5 hours ago•CVE-2026-120792
7.3CVE-2026-120792: Local Information Disclosure via Temporary File Logging in Microsoft .NET Aspire CLI
CVE-2026-120792 is a high-severity local information disclosure vulnerability in the Microsoft .NET Aspire CLI (Aspire.Cli) affecting versions 13.5.4 prior to 13.6.5. The flaw stems from the insertion of sensitive information into a shared temporary log file (CWE-532) combined with insecure temporary file creation (CWE-377) within the DeprecatedMcpCommandScanner component. During agent configuration scanning, the CLI unconditionally appends internal workspace paths and the first 200 characters of Model Context Protocol (MCP) agent configuration files to a statically named file in the system temporary directory. On multi-user systems, unprivileged local users can read this file to harvest API keys, authentication tokens, and internal service endpoints.
4 views•9 min read
•about 6 hours ago•CVE-2026-114159
8.8CVE-2026-114159: Heap-Based Buffer Overflow in Microsoft Visual Studio and .NET Native Symbol Reader
CVE-2026-114159 is a heap-based buffer overflow vulnerability (CWE-122) in Microsoft.DiaSymReader.Native affecting Microsoft Visual Studio and the .NET Runtime on Windows. An integer truncation error during the parsing of oversized document names in Portable PDB symbol files causes an undersized heap allocation, leading to an out-of-bounds memory write and remote code execution.
6 views•10 min read
•about 7 hours ago•CVE-2026-114158
8.8CVE-2026-114158: Heap-Based Buffer Overflow in Microsoft.DiaSymReader.Native Portable PDB Parser
CVE-2026-114158 is a high-severity remote code execution vulnerability affecting Microsoft Visual Studio 2026 and multiple supported servicing branches of Microsoft .NET (.NET 8.0, 9.0, 10.0, and 11.0) on Windows. The flaw resides in the native symbol reader library, Microsoft.DiaSymReader.Native, and is triggered when parsing Portable Program Database (PDB) metadata containing malformed EmbeddedSource custom debug information records. By supplying a parent Record Identifier (RID) of zero or an out-of-bounds value, an attacker causes an integer underflow during 1-based to 0-based index conversion, leading to a heap-based buffer overflow and arbitrary code execution within the context of the host developer tool or runtime.
5 views•10 min read
•about 8 hours ago•CVE-2026-114151
8.8CVE-2026-114151: Remote Code Execution via Stack-Based Buffer Overflow in Microsoft Visual Studio and .NET Symbol Reader
CVE-2026-114151 is a high-severity remote code execution vulnerability affecting Microsoft Visual Studio 2026 and multiple supported versions of the Microsoft .NET runtime on Windows. The flaw resides in the native Debug Information Access (DIA) symbol reader component, Microsoft.DiaSymReader.Native. When parsing Program Database (.pdb) files, the component fails to validate the length of serialized numeric records (specifically LF_DECIMAL structures) before unpacking them into a fixed-size stack buffer. An attacker who convinces a user or automated diagnostic process to load a crafted .pdb file can trigger a stack-based buffer overflow, resulting in arbitrary code execution within the context of the host process.
5 views•9 min read
•about 9 hours ago•GHSA-6856-87HX-P5X7
7.5CVE-2026-105544: Local Elevation of Privilege in .NET Test Platform CLI
CVE-2026-105544 is a high-severity local elevation of privilege vulnerability in Microsoft .NET and Microsoft.TestPlatform.CLI. Improper access control on local inter-process communication mechanisms and execution brokers allows an authorized local attacker to cross security boundaries and execute arbitrary code in the context of a higher-privileged user running a test execution cycle.
6 views•9 min read
•about 11 hours ago•CVE-2026-114152
8.8CVE-2026-114152: Stack-Based Buffer Overflow and Untrusted Pointer Dereference in Microsoft DiaSymReader.Native
CVE-2026-114152 is a high-severity remote code execution vulnerability affecting Microsoft Visual Studio 2026 and multiple servicing branches of the Microsoft .NET runtime (.NET 8.0, 9.0, 10.0, and 11.0) on Windows platforms. The vulnerability exists within the native symbol reader library, Microsoft.DiaSymReader.Native, specifically inside the DiaObjectFile::ApplyFixup method during the processing of Common Object File Format (COFF) relocation records. By supplying a malformed object file or Program Database (PDB) symbol file containing out-of-bounds relocation offsets or invalid symbol table indices, an unauthenticated attacker can trigger an untrusted pointer dereference (CWE-822) and a stack-based buffer overflow (CWE-121). Successful exploitation occurs when a victim opens, compiles, or debugs a malicious project or symbol artifact, leading to arbitrary code execution within the security context of the active developer environment or build process.
6 views•11 min read