# Microsoft.NETCore.App.Runtime.linux-musl-arm64 (NuGet) vulnerabilities 32 known vulnerabilities (1 critical, 21 high, 9 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 10.0.14 (Oct 25, 2026): no advisory affects it - Newest unaffected release: 10.0.14 (Oct 25, 2026), the latest release - Releases: 255 since 3.0.0 (Sep 23, 2019) - Registry: https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - GHSA-P3JP-9V83-76W9: 8.0.0 to 8.0.32 (8.0.33 is outside it); 9.0.0 to 9.0.21 (9.0.22 is outside it); 10.0.0 to 10.0.13 (10.0.14 is outside it); 11.0.0-preview.1.26104.118 to 11.0.0-rc.2.26504.105 (11.0.0-rc.3.26522.148 is outside it) - CVE-2026-50659: 8.0.0 to 8.0.28 (8.0.29 is outside it); 9.0.0 to 9.0.17 (9.0.18 is outside it); 10.0.0 to 10.0.9 (10.0.10 is outside it) - CVE-2026-50651: 8.0.0 to 8.0.28 (8.0.29 is outside it); 9.0.0 to 9.0.17 (9.0.18 is outside it); 10.0.0 to 10.0.9 (10.0.10 is outside it) - CVE-2026-50528: 8.0.0 to 8.0.28 (8.0.29 is outside it); 9.0.0 to 9.0.17 (9.0.18 is outside it); 10.0.0 to 10.0.9 (10.0.10 is outside it) - CVE-2026-50524: 8.0.0 to 8.0.28 (8.0.29 is outside it); 9.0.0 to 9.0.17 (9.0.18 is outside it); 10.0.0 to 10.0.9 (10.0.10 is outside it) - CVE-2026-47302: 8.0.0 to 8.0.28 (8.0.29 is outside it); 9.0.0 to 9.0.17 (9.0.18 is outside it); 10.0.0 to 10.0.9 (10.0.10 is outside it) - CVE-2026-57108: 8.0.0 to 8.0.28 (8.0.29 is outside it); 9.0.0 to 9.0.17 (9.0.18 is outside it); 10.0.0 to 10.0.9 (10.0.10 is outside it) - CVE-2026-32178: 8.0.0 to 8.0.25 (8.0.26 is outside it); 9.0.0 to 9.0.14 (9.0.15 is outside it); 10.0.0 to 10.0.5 (10.0.6 is outside it) - CVE-2026-26127: 9.0.0 to 9.0.13 (9.0.14 is outside it); 10.0.0 to 10.0.3 (10.0.4 is outside it) - CVE-2026-26131: 10.0.0 to 10.0.3 (10.0.4 is outside it) - CVE-2025-55248: 8.0.0 to 8.0.20 (8.0.21 is outside it); 9.0.0 to 9.0.9 (9.0.10 is outside it) - CVE-2025-30399: 8.0.0 to 8.0.16 (8.0.17 is outside it); 9.0.0 to 9.0.5 (9.0.6 is outside it) - CVE-2020-36846: 3.0.0 to 3.1.22 (3.1.23 is outside it); 5.0.0 to 5.0.14 (5.0.15 is outside it); 6.0.0 to 6.0.2 (6.0.3 is outside it) - CVE-2025-21172: 8.0.0 to 8.0.11 (8.0.12 is outside it); 9.0.0 (9.0.1 is outside it) - CVE-2025-21176: 8.0.0 to 8.0.11 (8.0.12 is outside it); 9.0.0 (9.0.1 is outside it) - CVE-2025-21171: 9.0.0 (9.0.1 is outside it) - CVE-2024-38167: 8.0.0 to 8.0.7 (8.0.8 is outside it) - CVE-2024-38095: 6.0.0 to 6.0.31 (6.0.32 is outside it); 8.0.0 to 8.0.6 (8.0.7 is outside it) - CVE-2024-30045: 7.0.0 to 7.0.18 (7.0.19 is outside it); 8.0.0 to 8.0.4 (8.0.5 is outside it) - CVE-2024-21392: 7.0.0-preview.1.22076.8 to 7.0.16 (7.0.17 is outside it); 8.0.0 to 8.0.2 (8.0.3 is outside it) - CVE-2023-36799: 6.0.0 to 6.0.21 (6.0.22 is outside it); 7.0.0 to 7.0.10 (7.0.11 is outside it) - CVE-2023-29331: 6.0.0 to 6.0.16 (6.0.18 is outside it); 7.0.0 to 7.0.5 (7.0.7 is outside it) - CVE-2023-24936: 6.0.0 to 6.0.16 (6.0.18 is outside it); 7.0.0 to 7.0.5 (7.0.7 is outside it) - CVE-2023-33128: 7.0.0 to 7.0.5 (7.0.7 is outside it) - CVE-2023-21538: 6.0.0 to 6.0.12 (6.0.13 is outside it) - CVE-2022-24512: 3.0.0 to 3.1.22 (3.1.23 is outside it); 5.0.0 to 5.0.14 (5.0.15 is outside it); 6.0.0 to 6.0.2 (6.0.3 is outside it) - CVE-2021-34485: 3.1.0 to 3.1.17 (3.1.18 is outside it); 5.0.0 to 5.0.8 (5.0.9 is outside it) - CVE-2021-26423: 3.1.0 to 3.1.17 (3.1.18 is outside it); 5.0.0 to 5.0.8 (5.0.9 is outside it) - CVE-2021-1721: 3.1.0 to 3.1.11 (3.1.12 is outside it); 5.0.0 to 5.0.2 (5.0.3 is outside it) - CVE-2020-8927: 3.0.0 to 3.1.22 (3.1.23 is outside it); 5.0.0 to 5.0.14 (5.0.15 is outside it); 6.0.0 to 6.0.2 (6.0.3 is outside it) - CVE-2020-1147: 3.1.0 to 3.1.5 (3.1.6 is outside it) - CVE-2020-1108: 3.1.0 to 3.1.3 (3.1.4 is outside it) ## Advisories (32) ### [GHSA-P3JP-9V83-76W9](https://cve.now/GHSA-P3JP-9V83-76W9): Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability - Severity: High - Published: Nov 3, 2026 - Affected: from 8.0.0, fixed in 8.0.33; from 9.0.0, fixed in 9.0.22; from 10.0.0, fixed in 10.0.14; from 11.0.0-preview.1, fixed in 11.0.0-rc.3.26522.148. - Fixed in 8.0.33 (released Oct 25, 2026, 9 days before disclosure), 9.0.22 (released Oct 25, 2026, 9 days before disclosure), 10.0.14 (released Oct 25, 2026, 9 days before disclosure) and 1 other version. - The latest release, 10.0.14, is not affected. ### [CVE-2026-50659](https://cve.now/CVE-2026-50659): .NET Spoofing Vulnerability - Severity: Medium 6.5 - Published: Jul 14, 2026 - Affected: from 10.0.0, fixed in 10.0.10; from 9.0.0, fixed in 9.0.18; from 8.0.0, fixed in 8.0.29. - Fixed in 8.0.29 (released Jul 14, 2026, the day of disclosure), 9.0.18 (released Jul 14, 2026, the day of disclosure) and 10.0.10 (released Jul 14, 2026, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2026-50651](https://cve.now/CVE-2026-50651): .NET Denial of Service Vulnerability - Severity: High 7.5 - Published: Jul 14, 2026 - Affected: from 10.0.0, fixed in 10.0.10; from 9.0.0, fixed in 9.0.18; from 8.0.0, fixed in 8.0.29. - Fixed in 8.0.29 (released Jul 14, 2026, the day of disclosure), 9.0.18 (released Jul 14, 2026, the day of disclosure) and 10.0.10 (released Jul 14, 2026, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2026-50528](https://cve.now/CVE-2026-50528): .NET Security Feature Bypass Vulnerability - Severity: High 8.2 - Published: Jul 14, 2026 - Affected: from 10.0.0, fixed in 10.0.10; from 9.0.0, fixed in 9.0.18; from 8.0.0, fixed in 8.0.29. - Fixed in 8.0.29 (released Jul 14, 2026, the day of disclosure), 9.0.18 (released Jul 14, 2026, the day of disclosure) and 10.0.10 (released Jul 14, 2026, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2026-50524](https://cve.now/CVE-2026-50524): .NET Framework Denial of Service Vulnerability - Severity: High 7.5 - Published: Jul 14, 2026 - Affected: from 10.0.0, fixed in 10.0.10; from 9.0.0, fixed in 9.0.18; from 8.0.0, fixed in 8.0.29. - Fixed in 8.0.29 (released Jul 14, 2026, the day of disclosure), 9.0.18 (released Jul 14, 2026, the day of disclosure) and 10.0.10 (released Jul 14, 2026, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2026-47302](https://cve.now/CVE-2026-47302): .NET Denial of Service Vulnerability - Severity: High 7.5 - Published: Jul 14, 2026 - Affected: from 10.0.0, fixed in 10.0.10; from 9.0.0, fixed in 9.0.18; from 8.0.0, fixed in 8.0.29. - Fixed in 8.0.29 (released Jul 14, 2026, the day of disclosure), 9.0.18 (released Jul 14, 2026, the day of disclosure) and 10.0.10 (released Jul 14, 2026, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2026-57108](https://cve.now/CVE-2026-57108): .NET Denial of Service Vulnerability - Severity: High 7.5 - Published: Jul 14, 2026 - Affected: from 10.0.0, fixed in 10.0.10; from 9.0.0, fixed in 9.0.18; from 8.0.0, fixed in 8.0.29. - Fixed in 8.0.29 (released Jul 14, 2026, the day of disclosure), 9.0.18 (released Jul 14, 2026, the day of disclosure) and 10.0.10 (released Jul 14, 2026, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2026-32178](https://cve.now/CVE-2026-32178): .NET Spoofing Vulnerability - Severity: High 7.5 - Published: Apr 14, 2026 - Affected: from 10.0.0, fixed in 10.0.6; from 9.0.0, fixed in 9.0.15; from 8.0.0, fixed in 8.0.26. - Fixed in 8.0.26 (released Apr 14, 2026, the day of disclosure), 9.0.15 (released Apr 14, 2026, the day of disclosure) and 10.0.6 (released Apr 14, 2026, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2026-26127](https://cve.now/CVE-2026-26127): .NET Denial of Service Vulnerability - Severity: High 7.5 - Published: Mar 10, 2026 - Affected: from 9.0.0, fixed in 9.0.14; from 10.0.0, fixed in 10.0.4. - Fixed in 9.0.14 (released Mar 10, 2026, the day of disclosure) and 10.0.4 (released Mar 10, 2026, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2026-26131](https://cve.now/CVE-2026-26131): .NET Elevation of Privilege Vulnerability - Severity: High 7.8 - Published: Mar 10, 2026 - Affected: from 10.0.0, fixed in 10.0.4. - Fixed in 10.0.4 (released Mar 10, 2026, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2025-55248](https://cve.now/CVE-2025-55248): .NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability - Severity: Medium 4.8 - Published: Oct 14, 2025 - Affected: from 9.0.0, fixed in 9.0.10; from 8.0.0, fixed in 8.0.21. - Fixed in 8.0.21 (released Oct 14, 2025, the day of disclosure) and 9.0.10 (released Oct 14, 2025, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2025-30399](https://cve.now/CVE-2025-30399): .NET and Visual Studio Remote Code Execution Vulnerability - Severity: High 7.5 - Published: Jun 13, 2025 - Affected: from 9.0.0, fixed in 9.0.6; from 8.0.0, fixed in 8.0.17. - Fixed in 8.0.17 (released Jun 10, 2025, 3 days before disclosure) and 9.0.6 (released Jun 10, 2025, 3 days before disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2020-36846](https://cve.now/CVE-2020-36846): IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library - Severity: Critical 9.8 - Published: May 30, 2025 - Affected: from 3.0.0, fixed in 3.1.23; from 5.0.0, fixed in 5.0.15; from 6.0.0, fixed in 6.0.3. - Fixed in 3.1.23 (released Mar 8, 2022, 1179 days before disclosure), 5.0.15 (released Mar 8, 2022, 1179 days before disclosure) and 6.0.3 (released Mar 8, 2022, 1179 days before disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2025-21172](https://cve.now/CVE-2025-21172): .NET and Visual Studio Remote Code Execution Vulnerability - Severity: High 7.5 - Published: Jan 14, 2025 - Affected: from 9.0.0, fixed in 9.0.1; from 8.0.0, fixed in 8.0.12. - Fixed in 8.0.12 (released Jan 14, 2025, the day of disclosure) and 9.0.1 (released Jan 14, 2025, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2025-21176](https://cve.now/CVE-2025-21176): .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability - Severity: High 8.8 - Published: Jan 14, 2025 - Affected: from 9.0.0, fixed in 9.0.1; from 8.0.0, fixed in 8.0.12. - Fixed in 8.0.12 (released Jan 14, 2025, the day of disclosure) and 9.0.1 (released Jan 14, 2025, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2025-21171](https://cve.now/CVE-2025-21171): .NET Remote Code Execution Vulnerability - Severity: High 7.5 - Published: Jan 14, 2025 - Affected: from 9.0.0, fixed in 9.0.1. - Fixed in 9.0.1 (released Jan 14, 2025, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2024-38167](https://cve.now/CVE-2024-38167): .NET and Visual Studio Information Disclosure Vulnerability - Severity: Medium 6.5 - Published: Aug 13, 2024 - Affected: from 8.0.0, fixed in 8.0.8. - Fixed in 8.0.8 (released Aug 13, 2024, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2024-38095](https://cve.now/CVE-2024-38095): .NET and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: Jul 9, 2024 - Affected: from 8.0.0, fixed in 8.0.7; from 6.0.0, fixed in 6.0.32. - Fixed in 6.0.32 (released Jul 9, 2024, the day of disclosure) and 8.0.7 (released Jul 9, 2024, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2024-30045](https://cve.now/CVE-2024-30045): .NET and Visual Studio Remote Code Execution Vulnerability - Severity: Medium 6.3 - Published: May 14, 2024 - Affected: from 8.0.0, fixed in 8.0.5; from 7.0.0, fixed in 7.0.19. - Fixed in 7.0.19 (released May 14, 2024, the day of disclosure) and 8.0.5 (released May 14, 2024, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2024-21392](https://cve.now/CVE-2024-21392): .NET and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: Mar 12, 2024 - Affected: from 7.0.0-preview.1.22076.8, fixed in 7.0.17; from 8.0.0, fixed in 8.0.3. - Fixed in 7.0.17 (released Mar 12, 2024, the day of disclosure) and 8.0.3 (released Mar 12, 2024, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2023-36799](https://cve.now/CVE-2023-36799): .NET Core and Visual Studio Denial of Service Vulnerability - Severity: Medium 6.5 - Published: Sep 12, 2023 - Affected: from 7.0.0, fixed in 7.0.11; from 6.0.0, fixed in 6.0.22. - Fixed in 6.0.22 (released Sep 12, 2023, the day of disclosure) and 7.0.11 (released Sep 12, 2023, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2023-29331](https://cve.now/CVE-2023-29331): .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: Jun 14, 2023 - Affected: from 7.0.0, fixed in 7.0.7; from 6.0.0, fixed in 6.0.18. - Fixed in 6.0.18 (released Jun 13, 2023, 1 day before disclosure) and 7.0.7 (released Jun 13, 2023, 1 day before disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2023-24936](https://cve.now/CVE-2023-24936): .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability - Severity: High 7.5 - Published: Jun 14, 2023 - Affected: from 7.0.0, fixed in 7.0.7; from 6.0.0, fixed in 6.0.18. - Fixed in 6.0.18 (released Jun 13, 2023, 1 day before disclosure) and 7.0.7 (released Jun 13, 2023, 1 day before disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2023-33128](https://cve.now/CVE-2023-33128): .NET and Visual Studio Remote Code Execution Vulnerability - Severity: High 7.3 - Published: Jun 13, 2023 - Affected: from 7.0.0, fixed in 7.0.7. - Fixed in 7.0.7 (released Jun 13, 2023, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2023-21538](https://cve.now/CVE-2023-21538): .NET Denial of Service Vulnerability - Severity: High 7.5 - Published: Jan 10, 2023 - Affected: from 6.0.0, fixed in 6.0.13. - Fixed in 6.0.13 (released Jan 10, 2023, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2022-24512](https://cve.now/CVE-2022-24512): .NET and Visual Studio Remote Code Execution Vulnerability - Severity: Medium 6.3 - Published: Mar 9, 2022 - Affected: from 3.0.0, fixed in 3.1.23; from 5.0.0, fixed in 5.0.15; from 6.0.0, fixed in 6.0.3. - Fixed in 3.1.23 (released Mar 8, 2022, 1 day before disclosure), 5.0.15 (released Mar 8, 2022, 1 day before disclosure) and 6.0.3 (released Mar 8, 2022, 1 day before disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2021-34485](https://cve.now/CVE-2021-34485): .NET Core and Visual Studio Information Disclosure Vulnerability - Severity: Medium 5.0 - Published: Aug 12, 2021 - Affected: from 3.1.0, fixed in 3.1.18; from 5.0.0, fixed in 5.0.9. - Fixed in 3.1.18 (released Aug 10, 2021, 2 days before disclosure) and 5.0.9 (released Aug 10, 2021, 2 days before disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2021-26423](https://cve.now/CVE-2021-26423): .NET Core and Visual Studio Denial of Service Vulnerability - Severity: High 7.5 - Published: Aug 12, 2021 - Affected: from 3.1.0, fixed in 3.1.18; from 5.0.0, fixed in 5.0.9. - Fixed in 3.1.18 (released Aug 10, 2021, 2 days before disclosure) and 5.0.9 (released Aug 10, 2021, 2 days before disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2021-1721](https://cve.now/CVE-2021-1721): .NET Core and Visual Studio Denial of Service Vulnerability - Severity: Medium 6.5 - Published: Feb 25, 2021 - Affected: from 3.1.0, fixed in 3.1.12; from 5.0.0, fixed in 5.0.3. - Fixed in 3.1.12 (released Feb 9, 2021, 16 days before disclosure) and 5.0.3 (released Feb 9, 2021, 16 days before disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2020-8927](https://cve.now/CVE-2020-8927): Buffer overflow in Brotli library - Severity: Medium 5.3 - Published: Sep 15, 2020 - Affected: from 3.0.0, fixed in 3.1.23; from 5.0.0, fixed in 5.0.15; from 6.0.0, fixed in 6.0.3. - Fixed in 3.1.23 (released Mar 8, 2022, 539 days after disclosure), 5.0.15 (released Mar 8, 2022, 539 days after disclosure) and 6.0.3 (released Mar 8, 2022, 539 days after disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2020-1147](https://cve.now/CVE-2020-1147): A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the - Severity: High 7.8 ยท KEV - Published: Jul 14, 2020 - Affected: from 3.1.0, fixed in 3.1.6. - Fixed in 3.1.6 (released Jul 14, 2020, the day of disclosure). - The latest release, 10.0.14, is not affected. ### [CVE-2020-1108](https://cve.now/CVE-2020-1108): .NET Core & .NET Framework Denial of Service Vulnerability - Severity: Unrated - Published: May 21, 2020 - Affected: from 3.1.0, fixed in 3.1.4. - Fixed in 3.1.4 (released May 12, 2020, 9 days before disclosure). - The latest release, 10.0.14, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/nuget/microsoft.netcore.app.runtime.linux-musl-arm64 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.