CVE-2026-62902

A flaw was found in .NET. This vulnerability allows an unauthorized attacker to disclose sensitive information over a network. The issue arises from the inclusion of functionality from an untrusted control sphere, which can be exploited to reveal data.

Red Hat has determined that shipped versions of .NET in Red Hat products already include the fix for this vulnerability. The .NET 8.0 (8.0.30), 9.0 (9.0.19), and 10.0 (10.0.11) runtime fix versions are included in current Red Hat packages. Furthermore, the upstream advisory identifies only Microsoft.WindowsDesktop.App.Runtime (Windows Desktop) packages as vulnerable — a component not present in Red Hat's Linux .NET builds.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is needed. All shipped versions of .NET in Red Hat products already contain the fix for this vulnerability.