Medium severity6.2NVD Advisory· Published Jun 9, 2026· Updated Jun 9, 2026

CVE-2026-45491

Description

Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
Microsoft.NETCore.App.Runtime.linux-x64NuGet	>= 8.0.0, < 8.0.28	8.0.28
Microsoft.NETCore.App.Runtime.linux-x64NuGet	>= 9.0.0, < 9.0.17	9.0.17
Microsoft.NETCore.App.Runtime.linux-x64NuGet	>= 10.0.0, < 10.0.9	10.0.9
Microsoft.NETCore.App.Runtime.win-x64NuGet	>= 8.0.0, < 8.0.28	8.0.28
Microsoft.NETCore.App.Runtime.win-x64NuGet	>= 9.0.0, < 9.0.17	9.0.17
Microsoft.NETCore.App.Runtime.win-x64NuGet	>= 10.0.0, < 10.0.9	10.0.9
Microsoft.NETCore.App.Runtime.osx-arm64NuGet	>= 8.0.0, < 8.0.28	8.0.28
Microsoft.NETCore.App.Runtime.osx-arm64NuGet	>= 9.0.0, < 9.0.17	9.0.17
Microsoft.NETCore.App.Runtime.osx-arm64NuGet	>= 10.0.0, < 10.0.9	10.0.9

Affected products

Net/.NETllm-fuzzy
Microsoft/Netllm-fuzzy
osv-coords50 versions
pkg:apk/chainguard/dotnet-bootstrap-8 pkg:apk/chainguard/dotnet-bootstrap-9 pkg:apk/wolfi/dotnet-bootstrap-8 pkg:apk/wolfi/dotnet-bootstrap-9 pkg:bitnami/dotnet pkg:bitnami/dotnet-sdk pkg:nuget/microsoft.netcore.app.runtime.linux-x64 pkg:nuget/microsoft.netcore.app.runtime.osx-arm64 pkg:nuget/microsoft.netcore.app.runtime.win-x64 pkg:rpm/almalinux/aspnetcore-runtime-10.0 pkg:rpm/almalinux/aspnetcore-runtime-8.0 pkg:rpm/almalinux/aspnetcore-runtime-9.0 pkg:rpm/almalinux/aspnetcore-runtime-dbg-10.0 pkg:rpm/almalinux/aspnetcore-runtime-dbg-8.0 pkg:rpm/almalinux/aspnetcore-runtime-dbg-9.0 pkg:rpm/almalinux/aspnetcore-targeting-pack-10.0 pkg:rpm/almalinux/aspnetcore-targeting-pack-8.0 pkg:rpm/almalinux/aspnetcore-targeting-pack-9.0 pkg:rpm/almalinux/dotnet pkg:rpm/almalinux/dotnet-apphost-pack-10.0 pkg:rpm/almalinux/dotnet-apphost-pack-8.0 pkg:rpm/almalinux/dotnet-apphost-pack-9.0 pkg:rpm/almalinux/dotnet-host pkg:rpm/almalinux/dotnet-hostfxr-10.0 pkg:rpm/almalinux/dotnet-hostfxr-8.0 pkg:rpm/almalinux/dotnet-hostfxr-9.0 pkg:rpm/almalinux/dotnet-runtime-10.0 pkg:rpm/almalinux/dotnet-runtime-8.0 pkg:rpm/almalinux/dotnet-runtime-9.0 pkg:rpm/almalinux/dotnet-runtime-dbg-10.0 pkg:rpm/almalinux/dotnet-runtime-dbg-8.0 pkg:rpm/almalinux/dotnet-runtime-dbg-9.0 pkg:rpm/almalinux/dotnet-sdk-10.0 pkg:rpm/almalinux/dotnet-sdk-10.0-source-built-artifacts pkg:rpm/almalinux/dotnet-sdk-8.0 pkg:rpm/almalinux/dotnet-sdk-8.0-source-built-artifacts pkg:rpm/almalinux/dotnet-sdk-9.0 pkg:rpm/almalinux/dotnet-sdk-9.0-source-built-artifacts pkg:rpm/almalinux/dotnet-sdk-aot-10.0 pkg:rpm/almalinux/dotnet-sdk-aot-9.0 pkg:rpm/almalinux/dotnet-sdk-dbg-10.0 pkg:rpm/almalinux/dotnet-sdk-dbg-8.0 pkg:rpm/almalinux/dotnet-sdk-dbg-9.0 pkg:rpm/almalinux/dotnet-targeting-pack-10.0 pkg:rpm/almalinux/dotnet-targeting-pack-8.0 pkg:rpm/almalinux/dotnet-targeting-pack-9.0 pkg:rpm/almalinux/dotnet-templates-10.0 pkg:rpm/almalinux/dotnet-templates-8.0 pkg:rpm/almalinux/dotnet-templates-9.0 pkg:rpm/almalinux/netstandard-targeting-pack-2.1
< 8.0.129-r0+ 49 more
- (no CPE)range: < 8.0.129-r0
- (no CPE)range: < 9.0.119-r0
- (no CPE)range: < 8.0.129-r0
- (no CPE)range: < 9.0.119-r0
- (no CPE)range: >= 8.0.0, < 8.0.28
- (no CPE)range: >= 8.0.0, < 8.0.28
- (no CPE)range: >= 8.0.0, < 8.0.28
- (no CPE)range: >= 8.0.0, < 8.0.28
- (no CPE)range: >= 8.0.0, < 8.0.28
- (no CPE)range: < 10.0.9-1.el8_10
- (no CPE)range: < 8.0.28-1.el8_10
- (no CPE)range: < 9.0.17-1.el10_2
- (no CPE)range: < 10.0.9-1.el8_10
- (no CPE)range: < 8.0.28-1.el8_10
- (no CPE)range: < 9.0.17-1.el10_2
- (no CPE)range: < 10.0.9-1.el8_10
- (no CPE)range: < 8.0.28-1.el8_10
- (no CPE)range: < 9.0.17-1.el10_2
- (no CPE)range: < 10.0.109-1.el8_10
- (no CPE)range: < 10.0.9-1.el8_10
- (no CPE)range: < 8.0.28-1.el8_10
- (no CPE)range: < 9.0.17-1.el10_2
- (no CPE)range: < 10.0.9-1.el8_10
- (no CPE)range: < 10.0.9-1.el8_10
- (no CPE)range: < 8.0.28-1.el8_10
- (no CPE)range: < 9.0.17-1.el10_2
- (no CPE)range: < 10.0.9-1.el8_10
- (no CPE)range: < 8.0.28-1.el8_10
- (no CPE)range: < 9.0.17-1.el10_2
- (no CPE)range: < 10.0.9-1.el8_10
- (no CPE)range: < 8.0.28-1.el8_10
- (no CPE)range: < 9.0.17-1.el10_2
- (no CPE)range: < 10.0.109-1.el8_10
- (no CPE)range: < 10.0.109-1.el8_10
- (no CPE)range: < 8.0.128-1.el8_10
- (no CPE)range: < 8.0.128-1.el8_10
- (no CPE)range: < 9.0.118-1.el10_2
- (no CPE)range: < 9.0.118-1.el10_2
- (no CPE)range: < 10.0.109-1.el8_10
- (no CPE)range: < 9.0.118-1.el10_2
- (no CPE)range: < 10.0.109-1.el8_10
- (no CPE)range: < 8.0.128-1.el8_10
- (no CPE)range: < 9.0.118-1.el10_2
- (no CPE)range: < 10.0.9-1.el8_10
- (no CPE)range: < 8.0.28-1.el8_10
- (no CPE)range: < 9.0.17-1.el10_2
- (no CPE)range: < 10.0.109-1.el8_10
- (no CPE)range: < 8.0.128-1.el8_10
- (no CPE)range: < 9.0.118-1.el10_2
- (no CPE)range: < 9.0.118-1.el10_2

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-7q4v-2mr6-5gpxghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-45491ghsaADVISORY
github.com/dotnet/announcements/issues/404ghsaWEB
github.com/dotnet/runtime/security/advisories/GHSA-7q4v-2mr6-5gpxghsaWEB
msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45491nvdWEB

News mentions

Patch Tuesday - June 2026
Rapid7 Blog · Jun 9, 2026
Microsoft June 2026 Patch Tuesday fixes 3 zero-day, 200 flaws
BleepingComputer · Jun 9, 2026
Microsoft June 2026 Patch Tuesday fixes 6 zero-days, 200 flaws
BleepingComputer · Jun 9, 2026
Microsoft Patch Tuesday June 2026 – 198 Vulnerabilities Fixed, Including 3 Zero-days
Cyber Security News · Jun 9, 2026

cvss	0.403
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000