Skip to content
THREATWIRE
HighNo PoC

CVE-2026-114148

Unsafe file ownership in Linux .NET and ASP.NET Core tarballs enables local privilege escalation

Some Linux .NET tarballs carried unsafe ownership metadata. If extraction keeps that ownership, a local account may modify runtime files used by a more privileged app. Affects .NET 8 and 9 ASP.NET Core runtime and targeting-pack tarballs, and source-built .NET 8 to 11 tarballs. Fixed 25 October 2026. Microsoft CVSS 3.1 7.8. Not yet on CVE.org or NVD. Not in CISA KEV.

By ThreatWire Desk · Published 25 Oct 2026 · Updated 26 Oct 2026

CVSS
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Class
LPE
Status
No PoC
KEV
Not in CISA KEV
0-day
No
Vendor
Microsoft
Products
.NET, ASP.NET Core, .NET source-build
Affected
Linux only. Microsoft-published ASP.NET Core 8 regular and composite runtime tarballs and targeting-pack tarballs 8.0.0 before 8.0.33; the same for ASP.NET Core 9, 9.0.0 before 9.0.22. Other Microsoft-published runtime and SDK tarballs are not in scope. Source-built .NET 8 (8.0.100 before 8.0.133), .NET 9 (9.0.100 before 9.0.123), .NET 10.0.1xx (10.0.100 to 10.0.113), .NET 10.0.4xx (10.0.400 to 10.0.402) and .NET 11 previews up to 11.0.100-rc.2.26504.105. Exposure needs an extraction that preserves numeric file ownership, for example privileged extraction or an ownership-preserving container import.
Fixed
ASP.NET Core 8.0.33 and 9.0.22 tarballs. Source-build 8.0.133, 9.0.123, 10.0.114-servicing.26522.126, 10.0.403-servicing.26523.112 and 11.0.100-rc.3.26522.148. Released 25 October 2026. Existing installations must be replaced with a clean install; extracting over them does not fix ownership.
CWE
CWE-276
Published
25 Oct 2026
Updated
26 Oct 2026

No public PoC is confirmed on this record.

Timing: Microsoft disclosed this flaw on 25 October 2026, in its out-of-band .NET release.

CVE-2026-114148 is an incorrect default permissions flaw in some Linux .NET tarballs. The files inside carried unsafe ownership metadata.

It matters when extraction keeps the archive's numeric owner. Microsoft gives two examples: privileged extraction, and container imports that preserve ownership. A local account that then controls the installed files may modify files used by a more privileged app.

Microsoft scores it CVSS 3.1 7.8 (High) and rates it Important. The full vector is in the CVSS field. MSRC says a successful attacker could gain the highest privileges on the system.

Scope differs by version. On .NET 8 and 9, Microsoft-published ASP.NET Core runtime and targeting-pack tarballs are affected, not only source-build. Other Microsoft runtime and SDK tarballs are not. On .NET 10 and 11, only source-built tarballs are affected.

Fixed versions (25 October): ASP.NET Core 8.0.33 and 9.0.22 tarballs. Source-build 8.0.133, 9.0.123, 10.0.114, 10.0.403 and 11.0 RC3. Exact source-build tags are in the versions field.

A new archive alone does not fix an existing install. Microsoft says to install into a new, empty directory, without restoring the archive's ownership, then switch apps over. Rebuild custom container images too. Restoring the NuGet packages does not introduce the flaw.

Microsoft and the GitHub advisory title it slightly differently: "ASP.NET Core" versus ".NET" Elevation of Privilege. It is the same CVE.

Records: on 26 October, CVE.org had no published record and NVD had no entry. The data here comes from Microsoft's advisory only.

Microsoft credits Alen Cheung. MSRC says it was not publicly disclosed or exploited. It is not in CISA KEV (catalog 2026.10.23, checked 26 October). ThreatWire found no public proof of concept.

Read the full .NET out-of-band explainer.

Sources

Related on ThreatWire

Share on X@threatwire_https://www.threatwire.tech/cve/cve-2026-114148