8.8
Élevée
CVE-2026-102870 Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute…
Description
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Microsoft Visual Studio 2022 version 17.14 17.14 | 17.14.0 → < 17.14.43 | 17.14.43 |
| Microsoft Visual Studio 2026 version 18.10 18.10 | 18.10.0 → < 18.10.4 | 18.10.4 |
| Microsoft.AspNetCore.Components.WebAssembly.Server 10.0 | 10.0.0 → < 10.0.13 | 10.0.13 |
| .NET 10.0 installed on Linux 10.0 | 10.0.0 → < 10.0.403 | 10.0.403 |
| .NET 10.0 installed on Mac OS 10.0 | 10.0.0 → < 10.0.403 | 10.0.403 |
| .NET 10.0 installed on Windows 10.0 | 10.0.0 → < 10.0.403 | 10.0.403 |
| .NET 11.0 installed on Linux 11.0 | 11.0.0-preview.1 → < 11.0.100-rc.3 | 11.0.100-rc.3 |
| .NET 11.0 installed on Mac OS 11.0 | 11.0.0-preview.1 → < 11.0.100-rc.3 | 11.0.100-rc.3 |
| .NET 11.0 installed on Windows 11.0 | 11.0.0-preview.1 → < 11.0.100-rc.3 | 11.0.100-rc.3 |
Afficher les 4 autres branches Masquer les 4 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Microsoft Visual Studio 2019 version 16.11 16.11 | 16.11.0 → < 16.11.61 | 16.11.61 |
| Microsoft Visual Studio 2026 version 18.11 18.11 | 18.11.0 → < 18.11.2 | 18.11.2 |
| Microsoft Visual Studio 2026 version 18.12 18.12 | 18.12.0 → dernières | Pas de correctif indiqué |
| Microsoft.AspNetCore.Components.WebAssembly.DevServer 10.0 | premières → < 10.0.14 | 10.0.14 |
Références
- ASP.NET Core Remote Code Execution Vulnerability msrc.microsoft.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Microsoft Visual Studio 2022 version 17.14
Les 92 CVE de Microsoft Visual Studio 2022 version 17.14 →
CVE-2026-118147
Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network
7.4
Élevée
CVE-2026-109468
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service…
7.5
Élevée
CVE-2026-105016
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network
9.8
Critique
CVE-2026-70162
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests
5.9
Moyenne