.NET Improper Link Resolution Vulnerability Enables Local Privilege Escalation on Linux and macOS

An attacker with local access who is already authorized can exploit a flaw in Microsoft .NET to gain higher privileges on Linux and macOS machines. The vulnerability, identified as CVE-2026-96225, stems from improper link resolution before file access. According to the Microsoft Security Update Guide, this allows an authorized attacker to elevate privileges locally by manipulating how the runtime handles symbolic links.

How it unfolded

• Microsoft released an advisory detailing the elevation of privilege vulnerability in .NET.
• The GitHub advisory GHSA-w6wh-p4g7-mpj2 listed the affected packages and patched versions.
• The issue was classified as high severity with a CVSS 3.1 score of 7.8.

Who is affected

The vulnerability affects Microsoft .NET projects using specific runtime packages on Linux and macOS across all architectures. According to the GitHub advisory, versions of Microsoft.NETCore.App.Runtime from 8.0.0 up to 8.0.31 are vulnerable, as are versions from 9.0.0 up to 9.0.20. Additionally, .NET 10 versions from 10.0.0 to 10.0.12 and .NET 11 preview versions from 11.0.0-preview.1 to 11.0.0-rc.1 are impacted.

The fix

Microsoft has released patches for all affected versions. Users should update to .NET 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2 depending on their current installation. The GitHub advisory confirms that these patched versions resolve the improper link resolution issue. Teams should verify their current runtime versions against the affected ranges provided in the advisory to ensure they apply the correct update.

What made it possible

This class of vulnerability relies on race conditions involving symbolic links in global directories. Attackers exploit the time gap between checking a file path and accessing it, substituting the intended target with a malicious link. This technique serves to bypass permission checks, allowing an attacker to overwrite critical system files or modify directory permissions. It is a common method for escalating privileges when an attacker already has some level of local access to the system.

What to do and how to stay safe: Microsoft

• Audit your Linux and macOS servers to identify any applications running vulnerable .NET runtime versions.
• Apply the latest security updates for .NET 8, 9, 10, and 11 as soon as they are available.
• Monitor system logs for unusual file permission changes or unexpected privilege escalations.
• Restrict write access to global directories where possible to reduce the attack surface.

Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-96225?

The CVSS 3.1 score is 7.8, which Microsoft rates as high severity.

Which operating systems are affected by this vulnerability?

The vulnerability affects Linux and macOS systems running the specified .NET runtime versions.

Is there a patch available for .NET 8?

Yes, Microsoft has released version 8.0.32 to fix the vulnerability in .NET 8.