CVE-2026-102869
Description
A flaw was found in .NET and Visual Studio. A remote attacker could achieve privilege escalation by exploiting a type confusion vulnerability, which occurs when the software accesses a resource using an incompatible data type. Successful exploitation requires user interaction and may allow an unauthorized attacker to execute actions with elevated privileges over the network.
Statement
An IMPORTANT severity type confusion flaw (access of a resource using an incompatible type) was reported in Microsoft .NET and Visual Studio. A remote, unauthenticated attacker can exploit this flaw over a network to elevate privileges; successful exploitation requires user interaction and may allow the attacker to perform actions with elevated privileges, with high impact to the confidentiality, integrity, and availability of the affected application (CVSS 3.1 score 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The upstream Microsoft advisory lists only Microsoft Windows products, .NET Framework and Visual Studio, as affected. No Red Hat products are currently listed as affected for this flaw and no affected Red Hat component has been identified. The Red Hat impact rating (IMPORTANT) is consistent with the upstream severity rating (HIGH, 8.8).
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. No Red Hat products are currently listed as affected. Microsoft addresses this vulnerability in the affected .NET Framework and Visual Studio products through the Microsoft Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102869).
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
