CVE-2026-70354

A flaw was found in .NET. This vulnerability, caused by an out-of-bounds write, could allow an unauthorized attacker to execute code locally. Exploitation requires local access and user interaction, but if successful, it can lead to significant impact on the system's confidentiality, integrity, and availability.

Red Hat's .NET packages ship only the cross-platform runtime (Microsoft.NETCore.App.Runtime). CVE-2026-70354 affects exclusively Microsoft.WindowsDesktop.App.Runtime.win-* — the WinForms and WPF GUI subsystem, which is Windows-only and not included in any Red Hat .NET build. No Red Hat product is affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.