Link following in Microsoft products - CVE-2026-70165
Published: October 14, 2026
Vulnerability identifier: #VU154610
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-70165
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to improper link resolution before file access in .NET when accessing files. A local user can exploit a link-following race condition to escalate privileges.
Successful exploitation requires additional actions to prepare the target environment and user interaction.
Affected software
.NET
Visual Studio
Microsoft .NET Framework
Visual Studio
Microsoft .NET Framework
How to mitigate CVE-2026-70165
Install security update from vendor's website.
.NET - update to 9.0.319, 9.0.122
Visual Studio - update to 17.14.42
Microsoft .NET Framework - update to 10.0.402
Visual Studio - update to 17.14.42
Microsoft .NET Framework - update to 10.0.402