VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Aug 11, 2026· Updated Aug 14, 2026

CVE-2026-62902

CVE-2026-62902

Description

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet
>= 10.0.0, < 10.0.1110.0.11
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet
>= 10.0.0, < 10.0.1110.0.11
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet
>= 10.0.0, < 10.0.1110.0.11
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet
>= 9.0.0, < 9.0.199.0.19
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet
>= 9.0.0, < 9.0.199.0.19
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet
>= 9.0.0, < 9.0.199.0.19
Microsoft.WindowsDesktop.App.Runtime.win-arm64NuGet
>= 8.0.0, < 8.0.308.0.30
Microsoft.WindowsDesktop.App.Runtime.win-x64NuGet
>= 8.0.0, < 8.0.308.0.30
Microsoft.WindowsDesktop.App.Runtime.win-x86NuGet
>= 8.0.0, < 8.0.308.0.30

Affected products

7
  • Net\/.NETllm-fuzzy
  • Microsoft/Netllm-fuzzy2 versions
    (expand)+ 1 more
    • (no CPE)
    • cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*range: >=8.0.0,<8.0.30
  • osv-coords2 versions
    pkg:bitnami/dotnetpkg:bitnami/dotnet-sdk
    >= 8.0.0, < 8.0.30+ 1 more
    • (no CPE)range: >= 8.0.0, < 8.0.30
    • (no CPE)range: >= 8.0.0, < 8.0.30
  • Microsoft/Visual Studio2 versions
    cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*range: >=17.14.0,<17.14.38
    • cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*range: >=18.8.0,<18.8.3

Patches

Vulnerability mechanics

References

5

News mentions

3