CVE-2026-96232
Description
A flaw was found in .NET. This issue allows an unauthenticated remote attacker to trigger an out-of-bounds read, where the application reads memory outside of its intended boundaries. By sending specially crafted requests over the network, the attacker can access sensitive memory contents, leading to unauthorized information disclosure.
Statement
An out-of-bounds read vulnerability was found in .NET. An unauthenticated remote attacker could exploit this flaw by sending specially crafted network requests to an application running an affected .NET runtime or SDK. Successful exploitation allows the attacker to read memory outside of intended buffer boundaries, potentially exposing sensitive process memory without directly compromising system integrity or causing a denial of service.
Mitigation
Restrict network access to exposed .NET services to trusted clients only using firewall rules or ingress access control lists. Deploy affected .NET workloads in dedicated, non-privileged service accounts within isolated container boundaries to limit memory disclosure exposure.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
