CVE-2026-62886

A flaw was found in .NET. This vulnerability, caused by an integer overflow or wraparound, allows an unauthorized local attacker to elevate their privileges on the system. This could grant the attacker higher access than intended, potentially leading to further system compromise.

This vulnerability is an integer overflow in the .NET runtime that allows a local attacker to elevate privileges. Red Hat's currently shipped .NET 8.0, 9.0, and 10.0 packages across RHEL 8/9/10, RHEL for Edge/Automotive (rhivos), and Hummingbird already include the upstream fix (runtime 8.0.30, 9.0.19, and 10.0.11 respectively) and are therefore not affected. Red Hat Dev Spaces 3.29 (udi-rhel9) currently bundles .NET 8.0.29 and is affected pending a rebuild against 8.0.30. .NET 6.0 and 7.0 have reached end of life and fall outside the upstream-declared affected version ranges. .NET 11 is a pre-release preview and is not a supported product.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.