Dotnet6: Improperly controlled sequential memory allocation in .NET allows an unauthorized attacker to deny service over a network. (CVE-2026-92707)

This vulnerability in .NET arises from improperly controlled sequential memory allocation, which can be exploited by an unauthorized attacker to cause a denial of service (DoS) condition over a network. The vulnerability affects various versions of .NET distributed with Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 releases. Ubuntu has released updated .NET package versions (e.g., .NET 8 updated to 8.0.32, .NET 10 updated to 10.0.13, and .NET 11 updated to 11.0.0~rc2) that include fixes for this and other security issues. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating network attack vector, low attack complexity, no privileges or user interaction required, no confidentiality or integrity impact, but availability impact (denial of service). There are no known exploits in the wild. The vendor advisory from Ubuntu confirms the availability of patches and recommends updating to the fixed package versions.

An attacker can exploit this vulnerability to cause a denial of service condition remotely by triggering improper memory allocation in .NET. There is no impact on confidentiality or integrity, only availability is affected. No known active exploitation has been reported.

Apply the official patches provided by Ubuntu as detailed in security notice USN-8942-1. Updating to the fixed .NET package versions (e.g., 8.0.32, 10.0.13, 11.0.0~rc2) will remediate the vulnerability. Standard system updates on affected Ubuntu releases will install these fixes. No additional mitigation is required beyond applying these updates.