# Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet) vulnerabilities 24 known vulnerabilities (2 critical, 19 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 10.0.14 (Oct 25, 2026): no advisory affects it - Newest unaffected release: 10.0.14 (Oct 25, 2026), the latest release - Releases: 236 since 3.1.5 (Jun 9, 2020) - Registry: https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-88092: 8.0.0 to 8.0.31 (8.0.32 is outside it); 9.0.0 to 9.0.20 (9.0.21 is outside it); 10.0.0 to 10.0.12 (10.0.13 is outside it); 11.0.0-preview.1.26104.118 to 11.0.0-rc.1.26425.128 (11.0.0-rc.2.26504.105 is outside it) - CVE-2026-56170: 8.0.0 to 8.0.25 (8.0.26 is outside it); 9.0.0 to 9.0.14 (9.0.15 is outside it); 10.0.0 to 10.0.5 (10.0.6 is outside it) - CVE-2026-42899: 8.0.0 to 8.0.26 (8.0.27 is outside it); 9.0.0 to 9.0.15 (9.0.16 is outside it); 10.0.0 to 10.0.7 (10.0.8 is outside it) - CVE-2026-26130: 8.0.0 to 8.0.24 (8.0.25 is outside it); 9.0.0 to 9.0.13 (9.0.14 is outside it); 10.0.0 to 10.0.3 (10.0.4 is outside it) - CVE-2025-55315: 8.0.0 to 8.0.20 (8.0.21 is outside it); 9.0.0 to 9.0.9 (9.0.10 is outside it); 10.0.0-rc.1.25451.107 (10.0.0-rc.2.25502.107 is outside it) - CVE-2025-24070: 6.0.0 to 6.0.36 (7.0.0-preview.1.22109.13 is outside it); 8.0.0 to 8.0.13 (8.0.14 is outside it); 9.0.0 to 9.0.2 (9.0.3 is outside it) - CVE-2024-38229: 8.0.0 to 8.0.8 (8.0.10 is outside it); 9.0.0-preview.1.24081.5 to 9.0.0-rc.1.24452.1 (9.0.0-rc.2.24474.3 is outside it) - CVE-2024-38168: 8.0.0 to 8.0.7 (8.0.8 is outside it) - CVE-2024-35264: 8.0.0 to 8.0.6 (8.0.7 is outside it) - CVE-2024-30046: 7.0.0 to 7.0.18 (7.0.19 is outside it); 8.0.0 to 8.0.4 (8.0.5 is outside it) - CVE-2024-21386: 3.1.5 to 6.0.26 (6.0.27 is outside it); 7.0.0 to 7.0.15 (7.0.16 is outside it); 8.0.0 to 8.0.1 (8.0.2 is outside it) - CVE-2023-38180: 6.0.0 to 6.0.20 (6.0.21 is outside it); 7.0.0 to 7.0.9 (7.0.10 is outside it) - CVE-2023-38178: 7.0.0 to 7.0.9 (7.0.10 is outside it) - CVE-2023-33170: 3.1.5 to 6.0.19 (6.0.20 is outside it); 7.0.0 to 7.0.8 (7.0.9 is outside it) - CVE-2022-38013: 3.1.5 to 3.1.28 (3.1.29 is outside it); 5.0.0 to 6.0.8 (6.0.9 is outside it) - CVE-2022-34716: 3.1.5 to 3.1.27 (3.1.28 is outside it); 6.0.0 to 6.0.7 (6.0.8 is outside it) - CVE-2022-29145: 3.1.5 to 3.1.24 (3.1.25 is outside it); 5.0.0 to 5.0.16 (5.0.17 is outside it); 6.0.0 to 6.0.4 (6.0.5 is outside it) - CVE-2022-29117: 3.1.5 to 3.1.24 (3.1.25 is outside it); 5.0.0 to 5.0.16 (5.0.17 is outside it); 6.0.0 to 6.0.4 (6.0.5 is outside it) - CVE-2022-23267: 3.1.5 to 3.1.24 (3.1.25 is outside it); 5.0.0 to 5.0.16 (5.0.17 is outside it); 6.0.0 to 6.0.4 (6.0.5 is outside it) - CVE-2022-24464: 3.1.5 to 3.1.22 (3.1.23 is outside it); 5.0.0 to 5.0.14 (5.0.15 is outside it); 6.0.0 to 6.0.2 (6.0.3 is outside it) - CVE-2022-21986: 5.0.0 to 5.0.13 (5.0.14 is outside it); 6.0.0 to 6.0.1 (6.0.2 is outside it) - CVE-2021-1723: 3.1.5 to 3.1.10 (3.1.11 is outside it); 5.0.0 to 5.0.1 (5.0.2 is outside it) - CVE-2020-1045: 3.1.5 to 3.1.7 (3.1.8 is outside it) - CVE-2020-1597: 3.1.5 to 3.1.6 (3.1.7 is outside it) ## Advisories (24) ### [CVE-2026-88092](https://cve.now/CVE-2026-88092): ASP.NET Core Tampering Vulnerability - Severity: Critical 9.4 - Published: Oct 13, 2026 - Affected: from 8.0.0, fixed in 8.0.32; from 10.0.0, fixed in 10.0.13; from 11.0.0-preview.1, fixed in 11.0.0-rc.2; from 9.0.0, fixed in 9.0.21. - Fixed in 8.0.32 (released Oct 13, 2026, the day of disclosure), 9.0.21 (released Oct 13, 2026, the day of disclosure) and 10.0.13 (released Oct 13, 2026, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2026-56170](https://cve.now/CVE-2026-56170): ASP.NET Core Denial of Service Vulnerability - Severity: High 7.5 - Published: Jul 14, 2026 - Affected: from 10.0.0, fixed in 10.0.6; from 9.0.0, fixed in 9.0.15; from 8.0.0, fixed in 8.0.26. - Fixed in 8.0.26 (released Apr 14, 2026, 91 days before disclosure), 9.0.15 (released Apr 14, 2026, 91 days before disclosure) and 10.0.6 (released Apr 14, 2026, 91 days before disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2026-42899](https://cve.now/CVE-2026-42899): ASP.NET Core Denial of Service Vulnerability - Severity: High 7.5 - Published: May 12, 2026 - Affected: from 8.0.0, fixed in 8.0.27; from 9.0.0, fixed in 9.0.16; from 10.0.0, fixed in 10.0.8. - Fixed in 8.0.27 (released May 12, 2026, the day of disclosure), 9.0.16 (released May 12, 2026, the day of disclosure) and 10.0.8 (released May 12, 2026, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2026-26130](https://cve.now/CVE-2026-26130): ASP.NET Core Denial of Service Vulnerability - Severity: High 7.5 - Published: Mar 10, 2026 - Affected: from 8.0.0, fixed in 8.0.25; from 9.0.0, fixed in 9.0.14; from 10.0.0, fixed in 10.0.4. - Fixed in 8.0.25 (released Mar 10, 2026, the day of disclosure), 9.0.14 (released Mar 10, 2026, the day of disclosure) and 10.0.4 (released Mar 10, 2026, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2025-55315](https://cve.now/CVE-2025-55315): ASP.NET Security Feature Bypass Vulnerability - Severity: Critical 9.9 - Published: Oct 14, 2025 - Affected: from 10.0.0-rc.1.25451.107, fixed in 10.0.0-rc.2.25502.107; from 9.0.0, fixed in 9.0.10; from 8.0.0, fixed in 8.0.21. - Fixed in 8.0.21 (released Oct 14, 2025, the day of disclosure), 9.0.10 (released Oct 14, 2025, the day of disclosure) and 10.0.0-rc.2.25502.107 (released Oct 14, 2025, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2025-24070](https://cve.now/CVE-2025-24070): ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability - Severity: High 7.0 - Published: Mar 11, 2025 - Affected: from 9.0.0, fixed in 9.0.3; from 8.0.0, fixed in 8.0.14; from 6.0.0, through 6.0.36. - Fixed in 8.0.14 (released Mar 11, 2025, the day of disclosure) and 9.0.3 (released Mar 11, 2025, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2024-38229](https://cve.now/CVE-2024-38229): .NET and Visual Studio Remote Code Execution Vulnerability - Severity: High 8.1 - Published: Oct 8, 2024 - Affected: from 9.0.0-preview.1.24081.5, fixed in 9.0.0-rc.2.24474.3; from 8.0.0, fixed in 8.0.10. - Fixed in 8.0.10 (released Oct 8, 2024, the day of disclosure) and 9.0.0-rc.2.24474.3 (released Oct 8, 2024, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2024-38168](https://cve.now/CVE-2024-38168): .NET and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: Aug 13, 2024 - Affected: from 8.0.0, fixed in 8.0.8. - Fixed in 8.0.8 (released Aug 13, 2024, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2024-35264](https://cve.now/CVE-2024-35264): .NET and Visual Studio Remote Code Execution Vulnerability - Severity: High 8.1 - Published: Jul 9, 2024 - Affected: from 8.0.0, fixed in 8.0.7. - Fixed in 8.0.7 (released Jul 9, 2024, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2024-30046](https://cve.now/CVE-2024-30046): Visual Studio Denial of Service Vulnerability - Severity: Medium 5.9 - Published: May 14, 2024 - Affected: from 7.0.0, fixed in 7.0.19; from 8.0.0, fixed in 8.0.5. - Fixed in 7.0.19 (released May 14, 2024, the day of disclosure) and 8.0.5 (released May 14, 2024, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2024-21386](https://cve.now/CVE-2024-21386): .NET Denial of Service Vulnerability - Severity: High 7.5 - Published: Feb 13, 2024 - Affected: fixed in 6.0.27; from 7.0.0, fixed in 7.0.16; from 8.0.0, fixed in 8.0.2. - Fixed in 6.0.27 (released Feb 13, 2024, the day of disclosure), 7.0.16 (released Feb 13, 2024, the day of disclosure) and 8.0.2 (released Feb 13, 2024, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2023-38180](https://cve.now/CVE-2023-38180): .NET and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 ยท KEV - Published: Aug 8, 2023 - Affected: from 7.0.0, fixed in 7.0.10; from 6.0.0, fixed in 6.0.21. - Fixed in 6.0.21 (released Aug 8, 2023, the day of disclosure) and 7.0.10 (released Aug 8, 2023, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2023-38178](https://cve.now/CVE-2023-38178): .NET Core and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: Aug 8, 2023 - Affected: from 7.0.0, fixed in 7.0.10. - Fixed in 7.0.10 (released Aug 8, 2023, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2023-33170](https://cve.now/CVE-2023-33170): ASP.NET and Visual Studio Security Feature Bypass Vulnerability - Severity: High 8.1 - Published: Jul 11, 2023 - Affected: fixed in 6.0.20; from 7.0.0, fixed in 7.0.9. - Fixed in 6.0.20 (released Jul 11, 2023, the day of disclosure) and 7.0.9 (released Jul 11, 2023, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2022-38013](https://cve.now/CVE-2022-38013): .NET Core and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: Sep 13, 2022 - Affected: from 3.1.0, fixed in 3.1.29; from 5.0.0, fixed in 6.0.9. - Fixed in 3.1.29 (released Sep 13, 2022, the day of disclosure) and 6.0.9 (released Sep 13, 2022, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2022-34716](https://cve.now/CVE-2022-34716): .NET Spoofing Vulnerability - Severity: Medium 5.9 - Published: Aug 9, 2022 - Affected: from 3.1.0, fixed in 3.1.28; from 6.0.0, fixed in 6.0.8. - Fixed in 3.1.28 (released Aug 9, 2022, the day of disclosure) and 6.0.8 (released Aug 9, 2022, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2022-29145](https://cve.now/CVE-2022-29145): .NET and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: May 10, 2022 - Affected: from 3.0.0, fixed in 3.1.25; from 5.0.0, fixed in 5.0.17; from 6.0.0, fixed in 6.0.5. - Fixed in 3.1.25 (released May 10, 2022, the day of disclosure), 5.0.17 (released May 10, 2022, the day of disclosure) and 6.0.5 (released May 10, 2022, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2022-29117](https://cve.now/CVE-2022-29117): .NET and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: May 10, 2022 - Affected: from 3.0.0, fixed in 3.1.25; from 5.0.0, fixed in 5.0.17; from 6.0.0, fixed in 6.0.5. - Fixed in 3.1.25 (released May 10, 2022, the day of disclosure), 5.0.17 (released May 10, 2022, the day of disclosure) and 6.0.5 (released May 10, 2022, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2022-23267](https://cve.now/CVE-2022-23267): .NET and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: May 10, 2022 - Affected: from 3.0.0, fixed in 3.1.25; from 5.0.0, fixed in 5.0.17; from 6.0.0, fixed in 6.0.5. - Fixed in 3.1.25 (released May 10, 2022, the day of disclosure), 5.0.17 (released May 10, 2022, the day of disclosure) and 6.0.5 (released May 10, 2022, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2022-24464](https://cve.now/CVE-2022-24464): .NET and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: Mar 9, 2022 - Affected: from 3.1.5, fixed in 3.1.23; from 5.0.0, fixed in 5.0.15; from 6.0.0, fixed in 6.0.3. - Fixed in 3.1.23 (released Mar 8, 2022, 1 day before disclosure), 5.0.15 (released Mar 8, 2022, 1 day before disclosure) and 6.0.3 (released Mar 8, 2022, 1 day before disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2022-21986](https://cve.now/CVE-2022-21986): .NET Denial of Service Vulnerability - Severity: High 7.5 - Published: Feb 9, 2022 - Affected: from 5.0.0, fixed in 5.0.14; from 6.0.0, fixed in 6.0.2. - Fixed in 5.0.14 (released Feb 8, 2022, 1 day before disclosure) and 6.0.2 (released Feb 8, 2022, 1 day before disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2021-1723](https://cve.now/CVE-2021-1723): ASP.NET Core and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: Jan 12, 2021 - Affected: from 3.1.0, fixed in 3.1.11; from 5.0.0, fixed in 5.0.2. - Fixed in 3.1.11 (released Jan 12, 2021, the day of disclosure) and 5.0.2 (released Jan 12, 2021, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2020-1045](https://cve.now/CVE-2020-1045): Microsoft ASP.NET Core Security Feature Bypass Vulnerability - Severity: High 7.5 - Published: Sep 11, 2020 - Affected: from 3.1.5, fixed in 3.1.8. - Fixed in 3.1.8 (released Sep 8, 2020, 3 days before disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2020-1597](https://cve.now/CVE-2020-1597): ASP.NET Core Denial of Service Vulnerability - Severity: Unrated - Published: Aug 17, 2020 - Affected: from 3.1.0, fixed in 3.1.7. - Fixed in 3.1.7 (released Aug 11, 2020, 6 days before disclosure). - The latest release, 10.0.14, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/nuget/microsoft.aspnetcore.app.runtime.win-arm64 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.