Key points
- The flaw affects .NET versions 8, 9, 10 and 11 on Linux and macOS platforms.
- Microsoft assigns the issue a CVSS score of 7.8, rating it as high severity.
- Patches are available for all listed versions, including preview builds.
Microsoft has released updates to address a high-severity elevation of privilege vulnerability in the .NET runtime, identified as CVE-2026-96225. The flaw stems from improper link resolution, a weakness where the software fails to correctly handle symbolic links before accessing files. This behavior allows an authorized attacker to manipulate Unix named-mutex and shared-memory paths. According to the Microsoft Security Update Guide, the issue enables local privilege escalation on affected systems.
By the numbers
- CVSS 3.1 score of 7.8 for CVE-2026-96225
- .NET version 8.0.32 patches the runtime for version 8
- .NET version 9.0.21 patches the runtime for version 9
What the figures mean
The vulnerability impacts multiple architectures across Linux and macOS, including x64, ARM and ARM64 variants, as well as musl-based Linux distributions. According to the GitHub advisory GHSA-w6wh-p4g7-mpj2, the flaw affects package versions from 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and preview releases of version 11.0.0. The attack vector is local, requiring the attacker to have existing authorization on the system.
The underlying weakness is classified as CWE-59, improper link resolution before file access. Attackers can exploit insecure global directories and unsafe permission changes to truncate or overwrite files. They may also widen directory permissions to gain elevated access. This behavior is specific to Unix-like environments where named-mutex and shared-memory paths are manipulated through symlink races.
What to watch
Security operations teams should monitor for unauthorized changes to file permissions in global directories. Since the flaw involves symlink races, analysts should look for unexpected symbolic link creation in shared-memory locations. The vulnerability requires local access, so teams should focus on lateral movement indicators. Microsoft’s advisory notes that the issue allows attackers to elevate privileges, so any sudden privilege changes by low-level users warrant investigation.
Infection and persistence in general
Teams usually examine how malware arrives via compromised dependencies or supply chain attacks. Persistence often relies on modifying system libraries or injecting code into legitimate processes. Analysts check for unexpected changes in file permissions or the creation of symbolic links in sensitive directories. Spreading typically involves leveraging local privileges to access adjacent systems. Professionals review logs for abnormal process behavior and monitor for unauthorized access to shared-memory paths.
What to do and how to stay safe: Microsoft
- Verify that all .NET runtime packages are updated to the patched versions listed in the advisory.
- Audit global directories for unauthorized symbolic links or permission changes.
- Monitor for unusual process behavior related to named-mutex and shared-memory access.
- Review access logs for local privilege escalation attempts on Linux and macOS systems.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-96225?
Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0 preview releases are vulnerable.
What platforms are impacted by this vulnerability?
The flaw affects Linux and macOS across all architectures, including x64, ARM and ARM64.
Is there a patch available for this issue?
Yes, Microsoft has released patched versions for all affected .NET runtime packages.
