CVE-2026-62897
dotnet: .NET Framework: Local Code Execution via Integer Overflow
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · August 12, 2026
Updated · September 3, 2026
Description
A flaw was found in .NET Framework. This integer overflow or wraparound vulnerability allows an unauthorized attacker to execute code locally. By exploiting this flaw, an attacker could gain control over the affected system.
Statement
Red Hat's .NET packages ship only the cross-platform runtime (Microsoft.NETCore.App.Runtime). CVE-2026-62897 affects exclusively Microsoft.WindowsDesktop.App.Runtime.win-* — the WinForms and WPF GUI subsystem for Windows — and is not present in any Red Hat .NET Linux build. Red Hat has never shipped legacy .NET Framework (4.x) either. No Red Hat product is affected.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-190 · Integer Overflow or Wraparound