VYPR
← All advisories
High severity7.8NVD Advisory· Published Aug 11, 2026· Updated Aug 13, 2026

CVE-2026-62871

CVE-2026-62871

Description

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet
>= 10.0.0, < 10.0.1110.0.11
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet
>= 10.0.0, < 10.0.1110.0.11
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet
>= 10.0.0, < 10.0.1110.0.11
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet
>= 9.0.0, < 9.0.199.0.19
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet
>= 9.0.0, < 9.0.199.0.19
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet
>= 9.0.0, < 9.0.199.0.19
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet
>= 8.0.0, < 8.0.308.0.30
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet
>= 8.0.0, < 8.0.308.0.30
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet
>= 8.0.0, < 8.0.308.0.30

Affected products

6
  • osv-coords2 versions
    pkg:bitnami/dotnet-sdkpkg:bitnami/dotnet
    >= 8.0.0, < 8.0.30+ 1 more
    • (no CPE)range: >= 8.0.0, < 8.0.30
    • (no CPE)range: >= 8.0.0, < 8.0.30
  • Microsoft/Netllm-fuzzy2 versions
    (expand)+ 1 more
    • (no CPE)
    • cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*range: >=8.0.0,<8.0.30
  • Microsoft/Visual Studio2 versions
    cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*range: >=17.14.0,<17.14.38
    • cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*range: >=18.8.0,<18.8.3

Patches

Vulnerability mechanics

References

5

News mentions

2