Vulnerability-Lookup

BDU:2026-10353

Vulnerability from fstec - Published: 14.07.2026

Title

Уязвимость программной платформы Microsoft .NET Framework, связанная с нарушением механизма защиты данных, позволяющая нарушителю выполнить произвольный код

Description

Уязвимость программной платформы Microsoft .NET Framework связана с нарушением механизма защиты данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код

Severity


                    
                      AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vendor

ООО «Ред Софт», Microsoft Corp

Software Name

РЕД ОС (запись в едином реестре российских программ №3751), .NET, Microsoft .NET Framework 3.5, Microsoft .NET Framework 4.8.1, Microsoft .NET Framework 4.8, Microsoft .NET Framework 4.6.2, Microsoft .NET Framework 4.7, Microsoft .NET Framework 4.7.1, Microsoft .NET Framework 4.7.2

Software Version

7.3 (РЕД ОС), 8.0 (РЕД ОС), от 8.0 до 8.0.29 (.NET), от 9.0 до 9.0.18 (.NET), до 4.8.9340.0 (Microsoft .NET Framework 3.5), до 4.8.9340.0 (Microsoft .NET Framework 4.8.1), до 4.8.4803.0 (Microsoft .NET Framework 4.8), до 4.7.4143.0 (Microsoft .NET Framework 4.6.2), до 4.7.4143.0 (Microsoft .NET Framework 4.7), до 4.7.4143.0 (Microsoft .NET Framework 4.7.1), до 4.7.4143.0 (Microsoft .NET Framework 4.7.2), до 2.0.50727.9182 (Microsoft .NET Framework 3.5), до 3.0.30729.9168 (Microsoft .NET Framework 3.5), до 4.8.4803.0 (Microsoft .NET Framework 3.5), до 4.8.9339.0 (Microsoft .NET Framework 3.5), до 2.0.50727.9069 (Microsoft .NET Framework 3.5), до 3.0.30729.9067 (Microsoft .NET Framework 3.5), до 4.7.4143.0 (Microsoft .NET Framework 3.5), до 2.0.50727.8983 (Microsoft .NET Framework 3.5), до 3.0.30729.8978 (Microsoft .NET Framework 3.5), до 2.0.50727.9182 (Microsoft .NET Framework 4.8.1), до 3.0.30729.9168 (Microsoft .NET Framework 4.8.1), до 4.8.9339.0 (Microsoft .NET Framework 4.8.1), до 2.0.50727.9182 (Microsoft .NET Framework 4.8), до 3.0.30729.9168 (Microsoft .NET Framework 4.8), до 2.0.50727.9069 (Microsoft .NET Framework 4.8), до 3.0.30729.9067 (Microsoft .NET Framework 4.8), до 2.0.50727.8983 (Microsoft .NET Framework 4.7.2), до 3.0.30729.8978 (Microsoft .NET Framework 4.7.2), до 2.0.50727.9069 (Microsoft .NET Framework 4.7.2), до 3.0.30729.9067 (Microsoft .NET Framework 4.7.2)

Possible Mitigations

Использование рекомендаций производителя: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50646 Для Ред ОС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/ Для Ред ОС: http://repo.red-soft.ru/redos/8.0/x86_64/updates/

Reference

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50646 https://redos.red-soft.ru/support/secure/ https://redos.red-soft.ru/support/secure/

CWE

CWE-502, CWE-693

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "TO2873, TO2874, TO2875, TO2876, TO2877, TO2878, TO2879, TO2880, TO2881, TO2882, TO2883, TO2884, TO2885, TO2886, TO2887, TO2888, TO2889, TO2890, TO2891, TO2892, TO2893, TO2894, TO2895, TO2896",
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": "TO2873 \u041d\u0430\u043a\u043e\u043f\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET Framework 3.5, 4.7.2 \u0438 4.8 \u0434\u043b\u044f Windows 10 1809 \u0434\u043b\u044f x64 \u0441\u0438\u0441\u0442\u0435\u043c (KB5102201), TO2874 \u041d\u0430\u043a\u043e\u043f\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET Framework 3.5 \u0438 4.8 \u0434\u043b\u044f Windows Server 2019 \u0434\u043b\u044f x64 \u0441\u0438\u0441\u0442\u0435\u043c (KB5101008), TO2875 \u041d\u0430\u043a\u043e\u043f\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET Framework 3.5 \u0438 4.8.1 \u0434\u043b\u044f Windows 11 24H2 \u0434\u043b\u044f x64 \u0441\u0438\u0441\u0442\u0435\u043c (KB5101001), TO2876 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 9.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 dotnet-runtime-9.0.18), TO2877 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 9.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 dotnet-runtime-9.0.18), TO2878 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 8.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 dotnet-runtime-8.0.29), TO2879 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 8.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 dotnet-runtime-8.0.29), TO2880 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 9.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 windowsdesktop-runtime-9.0.18), TO2881 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 9.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 windowsdesktop-runtime-9.0.18), TO2882 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 8.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 windowsdesktop-runtime-8.0.29), TO2883 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 8.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 windowsdesktop-runtime-8.0.29), TO2884 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 9.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 dotnet-sdk-9.0.119), TO2885 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 9.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 dotnet-sdk-9.0.316), TO2886 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 9.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 dotnet-sdk-9.0.316), TO2887 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 8.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 dotnet-sdk-8.0.129), TO2888 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 8.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 dotnet-sdk-8.0.423), TO2889 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 8.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 dotnet-sdk-8.0.129), TO2890 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 8.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 dotnet-sdk-8.0.423), TO2891 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 8.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 ASP.NET Core Hosting Bundle 8.0.29), TO2892 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 9.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 ASP.NET Core Hosting Bundle 9.0.18), TO2893 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 9.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 ASP.NET Core Runtime 9.0.18), TO2894 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 9.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 ASP.NET Core Runtime 9.0.18), TO2895 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 8.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 ASP.NET Core Runtime 8.0.29), TO2896 \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 .NET 8.0 (\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 ASP.NET Core Runtime 8.0.29)",
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, Microsoft Corp",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "7.3 (\u0420\u0415\u0414 \u041e\u0421), 8.0 (\u0420\u0415\u0414 \u041e\u0421), \u043e\u0442 8.0 \u0434\u043e 8.0.29 (.NET), \u043e\u0442 9.0 \u0434\u043e 9.0.18 (.NET), \u0434\u043e 4.8.9340.0 (Microsoft .NET Framework 3.5), \u0434\u043e 4.8.9340.0 (Microsoft .NET Framework 4.8.1), \u0434\u043e 4.8.4803.0 (Microsoft .NET Framework 4.8), \u0434\u043e 4.7.4143.0 (Microsoft .NET Framework 4.6.2), \u0434\u043e 4.7.4143.0 (Microsoft .NET Framework 4.7), \u0434\u043e 4.7.4143.0 (Microsoft .NET Framework 4.7.1), \u0434\u043e 4.7.4143.0 (Microsoft .NET Framework 4.7.2), \u0434\u043e 2.0.50727.9182 (Microsoft .NET Framework 3.5), \u0434\u043e 3.0.30729.9168 (Microsoft .NET Framework 3.5), \u0434\u043e 4.8.4803.0 (Microsoft .NET Framework 3.5), \u0434\u043e 4.8.9339.0 (Microsoft .NET Framework 3.5), \u0434\u043e 2.0.50727.9069 (Microsoft .NET Framework 3.5), \u0434\u043e 3.0.30729.9067 (Microsoft .NET Framework 3.5), \u0434\u043e 4.7.4143.0 (Microsoft .NET Framework 3.5), \u0434\u043e 2.0.50727.8983 (Microsoft .NET Framework 3.5), \u0434\u043e 3.0.30729.8978 (Microsoft .NET Framework 3.5), \u0434\u043e 2.0.50727.9182 (Microsoft .NET Framework 4.8.1), \u0434\u043e 3.0.30729.9168 (Microsoft .NET Framework 4.8.1), \u0434\u043e 4.8.9339.0 (Microsoft .NET Framework 4.8.1), \u0434\u043e 2.0.50727.9182 (Microsoft .NET Framework 4.8), \u0434\u043e 3.0.30729.9168 (Microsoft .NET Framework 4.8), \u0434\u043e 2.0.50727.9069 (Microsoft .NET Framework 4.8), \u0434\u043e 3.0.30729.9067 (Microsoft .NET Framework 4.8), \u0434\u043e 2.0.50727.8983 (Microsoft .NET Framework 4.7.2), \u0434\u043e 3.0.30729.8978 (Microsoft .NET Framework 4.7.2), \u0434\u043e 2.0.50727.9069 (Microsoft .NET Framework 4.7.2), \u0434\u043e 3.0.30729.9067 (Microsoft .NET Framework 4.7.2)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50646\n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/\n\n\u0414\u043b\u044f \u0420\u0435\u0434 \u041e\u0421: http://repo.red-soft.ru/redos/8.0/x86_64/updates/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "14.07.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "01.09.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "22.07.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-10353",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-50646",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043d\u043e\u0433\u043e\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "\u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), .NET, Microsoft .NET Framework 3.5, Microsoft .NET Framework 4.8.1, Microsoft .NET Framework 4.8, Microsoft .NET Framework 4.6.2, Microsoft .NET Framework 4.7, Microsoft .NET Framework 4.7.1, Microsoft .NET Framework 4.7.2",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Microsoft Corp Windows Server 2012 - , Microsoft Corp Windows Server 2012 R2 - , Microsoft Corp Windows 10 1607 - 64-bit, Microsoft Corp Windows 10 1607 - 32-bit, Microsoft Corp Windows Server 2016 - , Microsoft Corp Windows Server 2012 R2 (Server Core installation) - , Microsoft Corp Windows Server 2016 (Server Core installation) - , Microsoft Corp Windows 10 1809 - 64-bit, Microsoft Corp Windows 10 1809 - 32-bit, Microsoft Corp Windows Server 2019 - , Microsoft Corp Windows Server 2019 (Server Core installation) - , Microsoft Corp Windows 10 1809 - ARM64, Microsoft Corp Windows Server 2022 - , Microsoft Corp Windows Server 2022 (Server Core installation) - , \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.3  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Microsoft Corp Windows 10 21H2 - 64-bit, Microsoft Corp Windows 10 21H2 - 32-bit, Microsoft Corp Windows 10 21H2 - ARM64, Microsoft Corp Windows 10 22H2 - 64-bit, Microsoft Corp Windows 10 22H2 - ARM64, Microsoft Corp Windows 10 22H2 - 32-bit, Microsoft Corp Windows Server 2012 (Server Core installation) - , Microsoft Corp Windows 11 23H2 - 64-bit, Microsoft Corp Windows 11 23H2 - ARM64, Microsoft Corp Windows 11 24H2 - 64-bit, Microsoft Corp Windows 11 24H2 - ARM64, Microsoft Corp Windows 11 25H2 - 64-bit, Microsoft Corp Windows 11 25H2 - ARM64, \u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 8.0  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Microsoft Corp Windows 11 26H1 - ARM64, Microsoft Corp Windows 11 26H1 - 64-bit",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft .NET Framework, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441  \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0412\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0435\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-502), \u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-693)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft .NET Framework \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441  \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445, \u041d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50646\nhttps://redos.red-soft.ru/support/secure/\nhttps://redos.red-soft.ru/support/secure/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-502, CWE-693",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,2)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)"
}

CVE-2026-50646 (GCVE-0-2026-50646)

Vulnerability from cvelistv5 – Published: 2026-07-14 19:29 – Updated: 2026-09-09 19:38

Title

.NET Framework Remote Code Execution Vulnerability

Summary

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-15 03:57 UTC

CWE

CWE-693 - Protection Mechanism Failure
CWE-502 - Deserialization of Untrusted Data

Assigner

microsoft mitre root

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisorypatch

Impacted products

11 products

Vendor	Product	Version
Microsoft	.NET 8.0	Affected: 8.0.0 , < 8.0.29 (custom)
Microsoft	.NET 9.0	Affected: 9.0.0 , < 9.0.18 (custom)
Microsoft	Microsoft .NET Framework 3.5	Affected: 3.5.0 , < 2.0.50727.8983 & 3.0.30729.8978 (custom)
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2	Affected: 4.7.0 , < 2.0.50727.8983 & 3.0.30729.8978 & 4.7.4143.0 (custom)
Microsoft	Microsoft .NET Framework 3.5 AND 4.8	Affected: 4.8.0 , < 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 (custom)
Microsoft	Microsoft .NET Framework 3.5 AND 4.8.1	Affected: 4.8.1 , < 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 (custom)
Microsoft	Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2	Affected: 4.7.0 , < 4.7.4143.0 (custom)
Microsoft	Microsoft .NET Framework 4.8	Affected: 4.8.0 , < 4.8.4803.0 (custom)
Microsoft	Microsoft Visual Studio 2022 version 17.12	Affected: 17.12.0 , < 17.12.22 (custom)
Microsoft	Microsoft Visual Studio 2022 version 17.14	Affected: 17.14.0 , < 17.14.36 (custom)
Microsoft	Microsoft Visual Studio 2026 version 18.7	Affected: 18.0 , < 18.7.4 (custom)

Date Public

2026-07-14 14:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50646",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T03:57:17.744564Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T11:00:59.975Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": ".NET 8.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "8.0.29",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": ".NET 9.0",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "9.0.18",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows Server 2012",
            "Windows Server 2012 (Server Core installation)",
            "Windows Server 2012 R2",
            "Windows Server 2012 R2 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "2.0.50727.8983 \u0026 3.0.30729.8978",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1607 for 32-bit Systems",
            "Windows 10 Version 1607 for x64-based Systems",
            "Windows 10 Version 1809 for 32-bit Systems",
            "Windows 10 Version 1809 for ARM64-based Systems",
            "Windows 10 Version 1809 for x64-based Systems",
            "Windows Server 2016",
            "Windows Server 2016 (Server Core installation)",
            "Windows Server 2019",
            "Windows Server 2019 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.7.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "2.0.50727.8983 \u0026 3.0.30729.8978 \u0026 4.7.4143.0",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1809 for 32-bit Systems",
            "Windows 10 Version 1809 for ARM64-based Systems",
            "Windows 10 Version 1809 for x64-based Systems",
            "Windows 10 Version 21H2 for 32-bit Systems",
            "Windows 10 Version 21H2 for ARM64-based Systems",
            "Windows 10 Version 21H2 for x64-based Systems",
            "Windows 10 Version 22H2 for 32-bit Systems",
            "Windows 10 Version 22H2 for ARM64-based Systems",
            "Windows 10 Version 22H2 for x64-based Systems",
            "Windows Server 2019",
            "Windows Server 2019 (Server Core installation)",
            "Windows Server 2022",
            "Windows Server 2022 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.8",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "2.0.50727.9069 \u0026 3.0.30729.9067 \u0026 4.8.4803.0",
              "status": "affected",
              "version": "4.8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 21H2 for 32-bit Systems",
            "Windows 10 Version 21H2 for ARM64-based Systems",
            "Windows 10 Version 21H2 for x64-based Systems",
            "Windows 10 Version 22H2 for 32-bit Systems",
            "Windows 10 Version 22H2 for ARM64-based Systems",
            "Windows 10 Version 22H2 for x64-based Systems",
            "Windows 11 Version 23H2 for ARM64-based Systems",
            "Windows 11 Version 23H2 for x64-based Systems",
            "Windows 11 Version 24H2 for ARM64-based Systems",
            "Windows 11 Version 24H2 for x64-based Systems",
            "Windows 11 Version 25H2 for ARM64-based Systems",
            "Windows 11 Version 25H2 for x64-based Systems",
            "Windows 11 Version 26H1 for ARM64-based Systems",
            "Windows 11 version 26H1 for x64-based Systems",
            "Windows Server 2022",
            "Windows Server 2022 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.8.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "2.0.50727.9182 \u0026 3.0.30729.9168 \u0026 4.8.9339.0",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows Server 2012",
            "Windows Server 2012 (Server Core installation)",
            "Windows Server 2012 R2",
            "Windows Server 2012 R2 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.7.4143.0",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1607 for 32-bit Systems",
            "Windows 10 Version 1607 for x64-based Systems",
            "Windows Server 2012",
            "Windows Server 2012 (Server Core installation)",
            "Windows Server 2012 R2",
            "Windows Server 2012 R2 (Server Core installation)",
            "Windows Server 2016",
            "Windows Server 2016 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 4.8",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.8.4803.0",
              "status": "affected",
              "version": "4.8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Microsoft Visual Studio 2022 version 17.12",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.12.22",
              "status": "affected",
              "version": "17.12.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Microsoft Visual Studio 2022 version 17.14",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "17.14.36",
              "status": "affected",
              "version": "17.14.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Microsoft Visual Studio 2026 version 18.7",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "18.7.4",
              "status": "affected",
              "version": "18.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.8.4803.0",
                  "versionStartIncluding": "4.8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.50727.9069 \u0026 3.0.30729.9067 \u0026 4.8.4803.0",
                  "versionStartIncluding": "4.8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.50727.8983 \u0026 3.0.30729.8978 \u0026 4.7.4143.0",
                  "versionStartIncluding": "4.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.7.4143.0",
                  "versionStartIncluding": "4.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.50727.9182 \u0026 3.0.30729.9168 \u0026 4.8.9339.0",
                  "versionStartIncluding": "4.8.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.0.29",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "9.0.18",
                  "versionStartIncluding": "9.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "18.7.4",
                  "versionStartIncluding": "18.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.12.22",
                  "versionStartIncluding": "17.12.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "17.14.36",
                  "versionStartIncluding": "17.14.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.50727.8983 \u0026 3.0.30729.8978",
                  "versionStartIncluding": "3.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-07-14T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en-US",
              "type": "CWE"
            },
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T19:38:46.361Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": ".NET Framework Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50646"
        }
      ],
      "title": ".NET Framework Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2026-50646",
    "datePublished": "2026-07-14T19:29:56.821Z",
    "dateReserved": "2026-06-05T14:33:50.830Z",
    "dateUpdated": "2026-09-09T19:38:46.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.