Bug 2562054 (CVE-2026-114148)

Summary:	CVE-2026-114148 dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability
Product:	[Other] Security Response	Reporter:	Charles Timko <ctimko>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain the highest privileges on the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-11-10

Description Charles Timko 2026-10-27 15:50:59 UTC

Microsoft is releasing this security advisory to provide information about a vulnerability in file ownership in Linux .NET tarball distributions, including ASP.NET Core runtime tarballs, ASP.NET Core Targeting Pack tarballs, and source-built .NET tarballs.
Incorrect ownership of runtime files installed from affected Linux tarballs can allow local elevation of privilege.
For Microsoft-published .NET 8 and .NET 9 distributions, only the ASP.NET Core runtime and targeting-pack Linux tarballs are affected. For source-build, every Linux tarball type is affected. Other Microsoft-published .NET runtime and SDK tarballs, and standalone NuGet packages, are not included in this scope.
The source-build product versions identify the corresponding SDK release.

CNA: microsoft
CNA impact: Elevation of Privilege
CWE: CWE-276
Platforms: linux
Architectures: all
CVSS 3.1: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Affected products:
- ASP.NET Core Runtime (release 8.0): 8.0.0 - 8.0.32; fixed 8.0.33
- .NET SDK (release 8.0): 8.0.100 - 8.0.132; fixed 8.0.133
- .NET SDK (release 9.0): 9.0.100 - 9.0.122; fixed 9.0.123
- .NET SDK (release 11.0): 11.0.100-preview.1.26104.118 - 11.0.100-rc.2.26504.105; fixed 11.0.100-rc.3.26522.148
- .NET SDK (release 10.0): 10.0.100 - 10.0.113; fixed 10.0.114-servicing.26522.126
- .NET SDK (release 10.0): 10.0.400 - 10.0.402; fixed 10.0.403-servicing.26523.112
- ASP.NET Core Runtime (release 9.0): 9.0.0 - 9.0.21; fixed 9.0.22

Comment 1 Jon Orris 2026-10-29 17:19:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:92420 https://access.redhat.com/errata/RHSA-2026:92420

Comment 2 Jon Orris 2026-10-29 17:29:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:92427 https://access.redhat.com/errata/RHSA-2026:92427

Comment 3 Jon Orris 2026-10-29 17:37:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:92431 https://access.redhat.com/errata/RHSA-2026:92431

Comment 4 Jon Orris 2026-10-29 18:25:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:92428 https://access.redhat.com/errata/RHSA-2026:92428

Comment 5 Jon Orris 2026-10-29 18:30:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:92430 https://access.redhat.com/errata/RHSA-2026:92430

Comment 6 Jon Orris 2026-10-29 19:58:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:92438 https://access.redhat.com/errata/RHSA-2026:92438

Comment 7 Jon Orris 2026-10-29 22:38:54 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:92511 https://access.redhat.com/errata/RHSA-2026:92511

Comment 8 Jon Orris 2026-10-29 22:48:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:92429 https://access.redhat.com/errata/RHSA-2026:92429

Comment 9 Jon Orris 2026-10-29 22:49:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:92432 https://access.redhat.com/errata/RHSA-2026:92432

Comment 10 Jon Orris 2026-10-29 22:49:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:92492 https://access.redhat.com/errata/RHSA-2026:92492

Comment 11 Jon Orris 2026-11-02 03:36:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:93455 https://access.redhat.com/errata/RHSA-2026:93455

Comment 12 Jon Orris 2026-11-02 03:36:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:93458 https://access.redhat.com/errata/RHSA-2026:93458

Comment 13 Jon Orris 2026-11-02 04:34:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:93456 https://access.redhat.com/errata/RHSA-2026:93456

Comment 14 Jon Orris 2026-11-02 05:25:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:93459 https://access.redhat.com/errata/RHSA-2026:93459

Comment 15 Jon Orris 2026-11-02 05:29:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:93457 https://access.redhat.com/errata/RHSA-2026:93457