CVE-2026-62909

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An Elevation of Privilege vulnerability (CVE-2026-62909) has been identified in the .NET diagnostics IPC channel, which allows an authorized local attacker to elevate privileges. When the default diagnostics socket name could not be generated or was truncated, the runtime silently fell back to binding an unnamed Unix domain socket — placing the endpoint in the Linux abstract socket namespace, where filesystem permissions do not apply.

Per CWE-284: Improper Access Control, the product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

This issue affects .NET 6. The diagnostics IPC channel ships in-box as part of the Microsoft.NETCore.App shared framework. Exposure is specific to Linux, where the abstract socket namespace exists; the vulnerable fallback is reached most readily when TMPDIR is long enough to truncate the generated socket path.

‍

Details

Module Info

• Product: .NET
• Affected packages: .NET diagnostics IPC (ships in the Microsoft.NETCore.App shared framework)
• Affected versions: Microsoft.NETCore.App >= 6.0.0 <= 6.0.43
• GitHub repository: https://github.com/dotnet/runtime
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager: NuGet
• Fixed in: NES for .NET 6.0.44

Vulnerability Info

This Medium-severity vulnerability is found in the diagnostics IPC transport as shipped in the .NET 6 shared framework. The runtime builds a Unix domain socket path for the diagnostics channel, then binds it. Two failure paths were not checked: the helper that generates the default socket name returned success unconditionally, and the snprintf that assembles the path could truncate. On either failure the allocation routine set the first byte of sun_path to a NUL terminator and continued:

server_address->sun_path[0] = '\0';

Binding a sockaddr_un whose sun_path begins with NUL does not fail. On Linux it places the endpoint in the abstract socket namespace, which is keyed by name alone and carries no filesystem ownership or permission bits. The diagnostics channel is consequently reachable by any local user sharing the process's network namespace — and that channel is not a read-only telemetry feed. It can attach a profiler, capture a process dump, and load code into the target process, so reaching it from an unprivileged account is a direct privilege escalation into the context of the .NET process.

The fixed release makes every step fail loudly rather than degrade:

• both get_default_name implementations return name[0] != '\0' instead of unconditionally true, so truncation is detected where it happens
• the address allocator checks those return values and the snprintf result rather than emptying sun_path
• an explicit empty-sun_path guard backstops both paths
• the allocation failure path raises an error and frees the partially constructed address instead of returning it

Applicability to .NET 6 was established from source, not from vendor metadata: the 6.0.43 tree carried the unconditional success return, the sun_path blanking, and the unchecked get_default_name call verbatim. Microsoft's published affected-version list names only .NET 8, 9 and 10.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • .NET >= 8.0.30
  • .NET >= 9.0.19
  • .NET >= 10.0.11
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.44 or later.

‍

Credits

Microsoft credits Kevin Gosse for reporting this vulnerability.