CVE-2026-105544

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An elevation of privilege vulnerability (CVE-2026-105544) exists in VSTest, the test platform the .NET SDK bundles to run dotnet test. Microsoft describes it as improper access control that lets an authorized attacker elevate privileges locally: VSTest's artifact post-processor, which handles a test session's results after its runs finish, can consume a forged executionComplete.json from another local user.

Per CWE-284: Improper Access Control, the weakness is a product that does not restrict, or incorrectly restricts, access to a resource from an unauthorized actor.

This issue affects .NET SDK 6.0.300 through 6.0.439 on Windows, Linux and macOS, on machines shared with another local user. HeroDevs investigation traced the .NET 6 NES impact to an opt-in path: the .NET 6 SDK ships the vulnerable code, but its dotnet test never enables artifact post-processing, which arrived in the .NET 7 SDK. A .NET 6 machine is exposed only when VSTest's undocumented artifact-processing switches are passed by hand. Built applications are not affected.

Details

Module Info

• Product: .NET SDK
• Affected packages: Microsoft.TestPlatform.CLI (VSTest, in-box in the .NET SDK, not an opt-in package)
• Affected versions:
  • .NET SDK >= 6.0.300 <= 6.0.439
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/microsoft/vstest
• Published packages: Download .NET (Linux, macOS, and Windows)
• Fixed in: NES for .NET 6.0.49 (.NET SDK 6.0.440)

Vulnerability Info

This High-severity vulnerability is found in VSTest's artifact post-processing (ArtifactProcessingManager in Microsoft.TestPlatform.CrossPlatEngine), which ships in Microsoft.TestPlatform.CLI 17.2 and later.

Artifact post-processing lets the test runs of one session hand their results to a final step. When the SDK supplies a test session correlation ID, each vstest.console run in collect mode saves executionComplete.json and runsettings.xml into a directory named after that ID under the system temporary directory. A later run in post-process mode reads those files back and runs the data collectors' post-processing on them. In affected versions the post-processor consumed whatever it found in that directory, so a local user who plants a forged executionComplete.json there can steer the output handling of a test session run by another user. Exploitation requires that victim's test run (user interaction) and has high attack complexity.

NES for .NET 6.0.49 updates the VSTest bundled in the .NET SDK from 17.3.3 to 17.3.4, Microsoft's fixed release for the 17.3 line.

The advisory's lower bound is Microsoft.TestPlatform.CLI 17.2.0-preview-20220301-01, so the weakness is present in every .NET 6 SDK from 6.0.300, the first to bundle VSTest 17.2.

Mitigation

.NET 6 is End-of-Life and will not receive any updates from Microsoft to address this issue. For more information see .NET and .NET Core official support policy. No Microsoft .NET 6 SDK carries the fixed VSTest 17.3.4, and a separately installed Microsoft.TestPlatform.CLI does not replace the SDK's bundled runner.

Users of the affected components should apply one of the following mitigations:

• Upgrade development and build machines to one of:
  • NES for .NET 6.0.49 (.NET SDK 6.0.440) or later
  • .NET SDK 10.0.115 (10.0.1xx) or 10.0.404 (10.0.4xx) or later
  • .NET SDK 11.0.100 or later
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.49 or later.

Credits

Microsoft acknowledges Weeraphat Srisutham and Ky0toFu in its security advisory.