What is CVE-2026-45491?

CVE-2026-45491 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. .NET Tampering Vulnerability

Which CVE IDs does CVE-2026-45491 cover?

CVE-2026-45491 covers the following CVE IDs: CVE-2026-45491. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2026-45491?

CVE-2026-45491 has a CVSS v3 base score of 6.2, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2026-45491?

CVE-2026-45491 affects 10 products, including: .NET 10.0 installed on Linux; .NET 10.0 installed on Mac OS; .NET 10.0 installed on Windows; .NET 8.0; .NET 8.0 installed on Linux; and others — see the full list on the advisory page.

CVE-2026-45491HighCVSS 6.2

.NET Tampering Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

June 10, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-45491 →

📋 Description

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

🎯 Affected products10

.NET 10.0 installed on Linux
.NET 10.0 installed on Mac OS
.NET 10.0 installed on Windows
.NET 8.0
.NET 8.0 installed on Linux
.NET 8.0 installed on Mac OS
.NET 8.0 installed on Windows
.NET 9.0 installed on Linux
.NET 9.0 installed on Mac OS
.NET 9.0 installed on Windows

✅ Remediation

KB5097148 (Security Update) — fixed build 10.0.9 KB5097149 (Security Update) — fixed build 8.0.28 KB5097150 (Security Update) — fixed build 9.0.17

🔗 References (7)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45491
patchhttps://dotnet.microsoft.com/download/dotnet/10.0
referencehttps://support.microsoft.com/help/5097148
patchhttps://dotnet.microsoft.com/download/dotnet/8.0
referencehttps://support.microsoft.com/help/5097149
patchhttps://dotnet.microsoft.com/download/dotnet/9.0
referencehttps://support.microsoft.com/help/5097150