Bug 2551456 (CVE-2026-70174)

Summary:	CVE-2026-70174 dotnet: .NET Remote Code Execution Vulnerability
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in .NET. An improperly implemented security check allows an unauthorized remote attacker to execute arbitrary code over the network. Successful exploitation requires user interaction and could allow an attacker to compromise the affected system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-13 20:39:53 UTC

Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.

Affected products:
- .NET Windows Desktop Runtime (release 11.0): 11.0.0-preview.1 - 11.0.0-rc.1; fixed 11.0.0-rc.2
- .NET Windows Desktop Runtime (release 8.0): 8.0.0 - 8.0.31; fixed 8.0.32
- .NET Windows Desktop Runtime (release 9.0): 9.0.0 - 9.0.20; fixed 9.0.21
- .NET Windows Desktop Runtime (release 10.0): 10.0.0 - 10.0.12; fixed 10.0.13