CVE-2026-47304

Description

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVSS Metrics

• v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
• v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.22%• Percentile: 12%

Techniques & Countermeasures

• CWE-347•Improper Verification of Cryptographic Signature

  The product does not verify, or incorrectly verifies, the cryptographic signature for data.

• CWE-345•Insufficient Verification of Data Authenticity

  The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Affected Systems

• chainguard•aspnet-8-targeting-pack

  < 8.0.131-r0

• chainguard•dotnet-8-sdk

  < 8.0.129-r1

• chainguard•dotnet-bootstrap-8

  < 8.0.129-r0 | < 8.0.130-r0

• chainguard•dotnet-bootstrap-9

  < 9.0.120-r0

• chainguard•dotnet-sdk-10.0.2

  < 10.0.204-r4

• chainguard•dotnet-sdk-10.0.3

  < 10.0.301-r5

• chainguard•powershell

  < 7.6.4-r1

• chainguard•promitor

  < 2.16.0-r3

• wolfi•aspnet-8-targeting-pack

  < 8.0.131-r0

• wolfi•dotnet-8-sdk

  < 8.0.129-r1

• wolfi•dotnet-bootstrap-8

  < 8.0.129-r0 | < 8.0.130-r0

• wolfi•dotnet-bootstrap-9

  < 9.0.120-r0

• wolfi•dotnet-sdk-10.0.2

  < 10.0.204-r4

• wolfi•dotnet-sdk-10.0.3

  < 10.0.301-r5

• wolfi•powershell

  < 7.6.4-r1

• wolfi•promitor

  < 2.16.0-r3

• ubuntu•dotnet10

  < 10.0.110-10.0.10-0ubuntu1~24.04.1 | < 10.0.110-10.0.10-0ubuntu1~26.04.1

• ubuntu•dotnet6

  all

• ubuntu•dotnet7

  all

• ubuntu•dotnet8

  < 8.0.129-8.0.29-0ubuntu1~22.04.1 | < 8.0.129-8.0.29-0ubuntu1~24.04.1

• microsoft•microsoft .net framework 3.5

  ≥ 3.5.0, < 2.0.50727.8983 & 3.0.30729.8978

• microsoft•microsoft .net framework 3.5 and 4.7.2

  ≥ 4.7.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0

• microsoft•microsoft .net framework 3.5 and 4.8

  ≥ 4.8.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0

• microsoft•microsoft .net framework 3.5 and 4.8.1

  ≥ 4.8.1, < 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0

• microsoft•microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2

  ≥ 4.7.0, < 4.7.4143.0

• microsoft•microsoft .net framework 4.8

  ≥ 4.8.0, < 4.8.4803.0

• microsoft•microsoft .net framework 4.8.1

  ≥ 4.8.0.0, < 4.8.9340.0

• microsoft•microsoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)

  -

• microsoft•microsoft visual studio 2019 version 16.11 (includes 16.0 - 16.10)

  -

• microsoft•microsoft visual studio 2022 version 17.12

  ≥ 17.12.0, < 17.12.22

• microsoft•microsoft visual studio 2022 version 17.14

  ≥ 17.14.0, < 17.14.36

• microsoft•microsoft visual studio 2026 version 18.5

  -

• microsoft•microsoft visual studio 2026 version 18.7

  ≥ 18.0, < 18.7.4

• microsoft•.net

  ≥ 8.0.0, < 8.0.29 | ≥ 9.0.0, < 9.0.18 | ≥ 10.0.0, < 10.0.6

• microsoft•.net 10.0

  ≥ 10.0.0, < 10.0.6 | ≥ 10.0.0, < 10.0.10

• microsoft•.net 8.0

  ≥ 8.0.0, < 8.0.29

• microsoft•.net 9.0

  ≥ 9.0.0, < 9.0.18

• microsoft•.net_framework

  4.8.1 | 4.8 | 4.6.2 | 4.7 | 4.7.1 | 4.7.2 | 3.5

• microsoft•visual_studio_2017

  ≥ 15.0, ≤ 15.9

• microsoft•visual_studio_2019

  ≥ 16.0, ≤ 16.11

• microsoft•visual_studio_2022

  ≥ 17.12.0, < 17.12.22 | ≥ 17.14.0, < 17.14.36

• microsoft•visual_studio_2026

  ≥ 18.7.0, < 18.7.4 | 18.5.0

• NuGet•System.Security.Cryptography.Xml

  ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.4

References (10)

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47304
• https://github.com/dotnet/runtime/security/advisories/GHSA-g8r8-53c2-pm3f
• https://nvd.nist.gov/vuln/detail/CVE-2026-47304
• https://github.com/dotnet/announcements/issues/412
• https://github.com/dotnet/runtime/issues/130709
• https://github.com/dotnet/runtime
• https://ubuntu.com/security/CVE-2026-47304
• https://www.cve.org/CVERecord?id=CVE-2026-47304
• https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-july-2026-servicing-updates
• https://ubuntu.com/security/notices/USN-8553-1