Link following in Microsoft products - CVE-2026-96231
Published: October 14, 2026
Vulnerability identifier: #VU155431
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-96231
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges to root.
The vulnerability exists due to improper link resolution before file access in .NET when accessing files. A local user can exploit link following during local file access to escalate privileges to root.
Affected software
Visual Studio
.NET for macOS
.NET for Linux
.NET for macOS
.NET for Linux
How to mitigate CVE-2026-96231
Install security update from vendor's website.
Visual Studio - update to 17.14.42
.NET for macOS - addressed in versions 8.0.32, 9.0.21
.NET for Linux - addressed in versions 8.0.32, 9.0.21
.NET for macOS - addressed in versions 8.0.32, 9.0.21
.NET for Linux - addressed in versions 8.0.32, 9.0.21