This Red Hat security advisory updates multiple dotnet9.0 RPM packages in Red Hat Hardened Images to fix vulnerabilities identified by CVE-2026-45736 and others. The update includes new versions of aspnetcore-runtime, dotnet-runtime, dotnet-sdk, and related targeting packs and templates for aarch64 and x86_64 architectures. The vulnerabilities involve several CWEs including CWE-824 (Access of Resource Using Incompatible Type), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-1287, CWE-59, CWE-120, CWE-551, CWE-807, CWE-502, CWE-94, and CWE-843, indicating a range of potential security weaknesses. The advisory does not provide a CVSS score and no known exploits are currently reported. The update is classified as a bug fix and enhancement update rather than a critical emergency patch.

The vulnerabilities addressed could potentially allow improper resource access, unsafe function usage, or other security weaknesses in the dotnet9.0 runtime and SDK components within Red Hat Hardened Images. While the advisory classifies the severity as high, there are no known exploits in the wild. The impact could include unauthorized access or denial of service if exploited, but specific exploitation details are not provided.

Red Hat has released updated RPM packages for dotnet9.0 components that include fixes and enhancements addressing these vulnerabilities. Users of Red Hat Hardened Images should apply the updates as provided in advisory RHSA-2026:27171 to remediate the issues. The vendor advisory provides detailed package versions and instructions for applying the update. No additional mitigation steps are indicated beyond applying the official update.