CVE-2026-108398

Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.

Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.

A deserialization of untrusted data vulnerability exists in .NET Framework. An unauthorized attacker can exploit this flaw to execute code over a network.

An out-of-bounds write exists in .NET Framework. An unauthorized attacker can exploit this vulnerability to execute code over a network.

Microsoft .NET Framework versions 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service.

Microsoft .NET Framework versions 2.0, 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, and 4.7 allows an attacker with access to the local system to execute malicious code, known as '.NET Remote Code Execution Vulnerability.'

The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, allowing remote attackers to bypass the Always Encrypted protection mechanism and obtain sensitive cleartext information.

Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, allowing remote attackers to cause a denial of service via crafted XSLT data.

Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 improperly parse internationalized resource identifiers, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted request to a .NET web application.

A vulnerability in Microsoft .NET Framework allows remote attackers to gain privileges through unverified data during interaction with the ClickOnce installer. It affects versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2.