Key points
- CVE-2026-96231 affects .NET runtimes on Linux and macOS across versions 8, 9, 10, and 11.
- The flaw allows local attackers to manipulate file paths via symlinks to gain higher privileges.
- Microsoft has released patched versions for all affected runtime packages, including preview releases.
A vulnerability in Microsoft .NET allows local attackers to elevate their privileges on Linux and macOS systems. The flaw, identified as CVE-2026-96231, stems from improper link resolution before file access. According to the Microsoft Security Update Guide, an authorized attacker can exploit this issue to gain higher-level access within the operating system.
The issue arises from insecure handling of Unix named-mutex and shared-memory paths. Attackers can manipulate these paths through symlink races and unsafe permission changes in global directories. This manipulation allows them to truncate or overwrite files, widen directory permissions, and ultimately elevate their privileges. The vulnerability carries a CVSS score of 7.8, rated as high severity.
What we know
Microsoft has released updated packages to address the flaw in System.Private.CoreLib and Microsoft.NETCore.App.Runtime. The affected platforms include all architectures on Linux and macOS. Developers using .NET 8 must update to version 8.0.32. Those on .NET 9 should move to version 9.0.21. Users of .NET 10 need to install version 10.0.13.
The fix also applies to preview releases of .NET 11. According to the GitHub advisory, developers using versions between 11.0.0-preview.1 and 11.0.0-rc.1 must update to 11.0.0-rc.2. The vulnerability affects runtime packages for various Linux distributions, including ARM, ARM64, and x64 builds, as well as macOS ARM64 and x64 environments.
Defender's checklist
- Inventory all servers and development machines running Linux or macOS to identify installed .NET runtime versions.
- Check package manifests for Microsoft.NETCore.App.Runtime packages matching the vulnerable version ranges listed in the advisory.
- Verify that CI/CD pipelines are not pulling older, vulnerable runtime versions for build or test environments.
- Monitor system logs for unusual file permission changes or symlink activity in global directories that could indicate exploitation attempts.
What analysts watch for
Teams usually monitor for unexpected modifications in shared memory segments and named mutexes in global directories. Analysts examine file system logs for rapid symlink creation followed by immediate file access by different users. They check for permission changes on critical system files that do not align with standard administrative actions. Reviewing process trees for child processes with elevated privileges spawned from lower-privileged contexts helps identify potential exploitation.
What to do and how to stay safe: Microsoft
- Update all .NET 8, 9, 10, and 11 runtime packages to the latest patched versions immediately.
- Audit your infrastructure to ensure no legacy or preview runtime versions remain in production or staging environments.
- Restrict write permissions in global directories used for shared memory or mutexes to limit the impact of symlink races.
- Monitor for abnormal privilege escalation events in your security information and event management systems once the vendor provides an update.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-96231?
Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1 are vulnerable.
What operating systems are at risk?
The vulnerability affects Linux and macOS systems across all supported architectures, including ARM, ARM64, and x64.
How severe is this vulnerability?
It is rated as high severity with a CVSS score of 7.8, allowing local attackers to elevate privileges through improper link resolution.
