CVE-2026-45490

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A vulnerability (CVE-2026-45490) exists in the .NET SDK dotnet workload command on Windows, where the elevated MSI installer server creates an inter-process communication named pipe that is accessible to every authenticated user on the machine and then acts on file paths supplied over that pipe without validating them. This can allow a local, low-privileged attacker to drive the elevated installer process into creating or truncating arbitrary files, such as through the unvalidated MSI LogFile path, resulting in elevation of privilege up to SYSTEM.

Per CWE-285: Improper Authorization, Improper Authorization is defined as a product that does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

This issue affects Windows installations of .NET 6 SDK versions 6.0.100 through 6.0.431 in NES-supported environments. Microsoft also serviced supported .NET releases in its June 9, 2026 security updates for .NET 8.0, .NET 9.0, and .NET 10.0.

‍

Details

Module Info

• Product:
  
  • Any .NET 6.0 SDK installation on Windows at SDK version 6.0.431 or earlier.
• Affected packages:
  
  • .NET SDK (Windows installations)
• Affected versions:
  
  • .NET 6 SDK: >= 6.0.100 <= 6.0.431
• GitHub repository: https://github.com/dotnet/sdk
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager:
  
  • NuGet
  • Windows Installer
  • Docker
• Fixed in: NES for .NET 6.0.41

Vulnerability Info

This High-severity vulnerability is found in the .NET SDK dotnet workload elevation path on Windows. When a workload install, update, or repair operation triggers a User Account Control elevation, the SDK spawns an elevated MSI installer server (dotnet.exe workload elevate) that communicates with the unelevated client over a named pipe. The pipe's access control list granted read and write access to every authenticated user on the machine, and the elevated server acted on file paths supplied over that pipe without validating them. As a result, any local user could send installer commands to the elevated server, supplying attacker-chosen paths such as the MSI LogFile or a manifest or package path, causing the elevated process to create, truncate, or move files as the elevated identity. This only affects .NET on Windows operating systems; runtime-only installations that do not include the SDK are not affected.

‍

Mitigation

.NET 6.x is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected sdk applications to one of:
  
  • .NET SDK >= 8.0.128 (or >= 8.0.422 on the 8.0.4xx feature band)
  • .NET SDK >= 9.0.118 (or >= 9.0.315 on the 9.0.3xx feature band)
  • .NET SDK >= 10.0.109 (or >= 10.0.301 on the 10.0.3xx feature band)
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.41 or later.

‍

Credits

• Ky0toFu