VYPR
← All advisories
High severity7.3NVD Advisory· Published May 12, 2026· Updated Jul 15, 2026

CVE-2026-35433

CVE-2026-35433

Description

Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet
>= 8.0.0, < 8.0.278.0.27
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet
>= 8.0.0, < 8.0.278.0.27
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet
>= 8.0.0, < 8.0.278.0.27
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet
>= 9.0.0, < 9.0.169.0.16
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet
>= 9.0.0, < 9.0.169.0.16
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet
>= 9.0.0, < 9.0.169.0.16
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet
>= 10.0.0, < 10.0.810.0.8
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet
>= 10.0.0, < 10.0.810.0.8
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet
>= 10.0.0, < 10.0.810.0.8

Affected products

8
  • Microsoft/Net2 versions
    cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*range: >=8.0.0,<8.0.27
    • (no CPE)
  • Microsoft/.net Framework4 versions
    cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*
  • osv-coords2 versions
    pkg:bitnami/dotnetpkg:bitnami/dotnet-sdk
    >= 8.0.0, < 8.0.27+ 1 more
    • (no CPE)range: >= 8.0.0, < 8.0.27
    • (no CPE)range: >= 8.0.0, < 8.0.27

Patches

Vulnerability mechanics

References

8

News mentions

2