高 7.5

.NETの脆弱性、ローカルで権限を昇格される恐れ

CVE-2026-114155 SecPulse初出 3:20

概要

.NETに、認証された攻撃者が権限を昇格できる脆弱性（CVE-2026-114155）が見つかりました。CVSSの基本値は7.5で、Linux版とmacOS版の.NET 10.0は10.0.404より前、.NET 11.0は11.0.100より前が影響を受けます。修正版は10.0.404と11.0.100で、早めの更新をおすすめします。

AI要約

SecPulse が外部の生成 AI を使って作った要約です。誤りを含むことがあります。重要な判断の前に、下の原文と参照URLを確認してください。

影響パッケージ

種類	パッケージ	影響を受ける版 → 修正版	修正版
Microsoft	Microsoft.NET 10.0 installed on Linux	10.0.0 以上 10.0.404 未満→ 10.0.404	10.0.404
Microsoft	Microsoft.NET 10.0 installed on Mac OS	10.0.0 以上 10.0.404 未満→ 10.0.404	10.0.404
Microsoft	Microsoft.NET 11.0 installed on Linux	11.0.0-preview.1 以上 11.0.100 未満→ 11.0.100	11.0.100
Microsoft	Microsoft.NET 11.0 installed on Mac OS	11.0.0-preview.1 以上 11.0.100 未満→ 11.0.100	11.0.100
Microsoft	MicrosoftMicrosoft.DotNet.HotReload.Watch.Aspire	10.0.300 以上 11.0.100 未満→ 11.0.100	11.0.100
NuGet	NuGetMicrosoft.DotNet.HotReload.Watch.Aspire	11.0.100-preview.3.26207.106 以上 11.0.100 未満→ 11.0.100	11.0.100

原文の説明取得元が公開している説明をそのまま載せています (多くは英語)。

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET SDK's dotnet-watch component. This advisory provides guidance on updating affected SDK installations.

A local attacker who can replace or modify a temporary solution file used by dotnet-watch can alter a subsequent build. The fix stores generated solution files in a private temporary directory and keeps each file open with read-only sharing while the build uses it.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/502

CVSS Details

Version: 3.1
Severity: High
Score: 7.5 (base score)
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Weakness: CWE-367
MSRC severity: Important
Impact: Elevation of Privilege

Affected Platforms

Platforms: Linux, macOS.
Architectures: Linux: Arm, Arm64, x64; macOS: Arm64, x64

Windows is outside this advisory's affected scope when its temporary directory is private to the current user, as assumed by the implementation. Shared or insecurely configured Windows temporary directories are not covered by that assumption.

Affected Packages

The .NET SDK includes dotnet-watch and the Microsoft.DotNet.HotReload.Watch assembly.

Each SDK feature band is a separate servicing line. Update an affected 10.0.3xx installation to the fixed 10.0.4xx SDK listed below.

.NET SDK 10.0.3xx

Package |…

出典: Microsoft Security Response Center Blog NVD GitHub Advisory