Threat Intelligence Database

CVE-2026-58649 is an origin validation error vulnerability in Microsoft .NET 10.0 that allows an unauthorized attacker to disclose information over a network. The vulnerability affects multiple versions of .NET including 8.0.0, 9.0.0, 10.0.0, 11.0.0, and specific ranges in 17.x and 18.x versions. It has a medium severity with a CVSS score of 6.5. An official fix is available from Microsoft.

Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.

Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.

Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.