CVE-2026-50659

Description

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
• v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS Trends

Current EPSS score: 0.55%• Percentile: 45%

Techniques & Countermeasures

• CWE-116•Improper Encoding or Escaping of Output

  The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Affected Systems

• chainguard•dotnet-bootstrap-8

  < 8.0.130-r0

• chainguard•dotnet-bootstrap-9

  < 9.0.120-r0

• wolfi•dotnet-bootstrap-8

  < 8.0.130-r0

• wolfi•dotnet-bootstrap-9

  < 9.0.120-r0

• microsoft•microsoft .net framework 3.5

  ≥ 3.5.0, < 2.0.50727.8983 & 3.0.30729.8978

• microsoft•microsoft .net framework 3.5 and 4.7.2

  ≥ 4.7.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0

• microsoft•microsoft .net framework 3.5 and 4.8

  ≥ 4.8.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0

• microsoft•microsoft .net framework 3.5 and 4.8.1

  ≥ 4.8.1, < 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0

• microsoft•microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2

  ≥ 4.7.0, < 4.7.4143.0

• microsoft•microsoft .net framework 4.8

  ≥ 4.8.0, < 4.8.4803.0

• microsoft•microsoft .net framework 4.8.1

  ≥ 4.8.0.0, < 4.8.9340.0

• microsoft•microsoft visual studio 2022 version 17.12

  ≥ 17.12.0, < 17.12.22

• microsoft•microsoft visual studio 2022 version 17.14

  ≥ 17.14.0, < 17.14.36

• microsoft•microsoft visual studio 2026 version 18.7

  ≥ 18.0, < 18.7.4

• microsoft•.net

  ≥ 8.0.0, < 8.0.29 | ≥ 9.0.0, < 9.0.18 | ≥ 10.0.0, < 10.0.6

• microsoft•.net 10.0

  ≥ 10.0.0, < 10.0.6 | ≥ 10.0.0, < 10.0.10

• microsoft•.net 8.0

  ≥ 8.0.0, < 8.0.29

• microsoft•.net 9.0

  ≥ 9.0.0, < 9.0.18

• microsoft•.net_framework

  4.8.1 | 4.8 | 4.6.2 | 4.7 | 4.7.1 | 4.7.2 | 3.5

• microsoft•visual_studio_2022

  ≥ 17.12.0, < 17.12.22 | ≥ 17.14.0, < 17.14.36

• microsoft•visual_studio_2026

  ≥ 18.7.0, < 18.7.4

• NuGet•Microsoft.NETCore.App.Runtime.linux-arm

  ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

• NuGet•Microsoft.NETCore.App.Runtime.linux-arm64

  ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

• NuGet•Microsoft.NETCore.App.Runtime.linux-musl-arm

  ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

• NuGet•Microsoft.NETCore.App.Runtime.linux-musl-arm64

  ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

• NuGet•Microsoft.NETCore.App.Runtime.linux-musl-x64

  ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

• NuGet•Microsoft.NETCore.App.Runtime.linux-x64

  ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

• NuGet•Microsoft.NETCore.App.Runtime.osx-arm64

  ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

• NuGet•Microsoft.NETCore.App.Runtime.osx-x64

  ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

• NuGet•Microsoft.NETCore.App.Runtime.win-arm

  ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

• NuGet•Microsoft.NETCore.App.Runtime.win-arm64

  ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

• NuGet•Microsoft.NETCore.App.Runtime.win-x64

  ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

• NuGet•Microsoft.NETCore.App.Runtime.win-x86

  ≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.29

References (6)

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50659
• https://github.com/dotnet/runtime/security/advisories/GHSA-74jp-vm22-8q8x
• https://nvd.nist.gov/vuln/detail/CVE-2026-50659
• https://github.com/dotnet/announcements/issues/423
• https://github.com/dotnet/runtime/issues/130716
• https://github.com/dotnet/runtime