Microsoft.NETCore.App.Runtime.win-arm64 (NuGet)

Known vulnerabilities and malicious package reports for Microsoft.NETCore.App.Runtime.win-arm64 on NuGet, live from OSV, with CISA KEV exploitation status and EPSS scores.

Known package reports

0 malicious package reports and 24 vulnerabilities returned by OSV. Check a specific version to see which reports apply.

GHSA-g5vf-38cp-4px9: Vulnerability

.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability

Published 2022-05-24.

Updated 2025-10-22.

Reported affected releases: 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5.

Affected ranges: introduced 3.1.0, fixed 3.1.6.

Fix versions reported by the advisory: 3.1.6.

Severity: HIGH.

Known to be exploited (CISA KEV).

CVE-2020-1147

GHSA-3w5p-jhp5-c29q: Vulnerability

.NET Core & .NET Framework Denial of Service Vulnerability

Published 2022-05-24.

Updated 2025-09-04.

Reported affected releases: 3.1.0, 3.1.1, 3.1.2, 3.1.3.

Affected ranges: introduced 3.1.0, fixed 3.1.4.

Fix versions reported by the advisory: 3.1.4.

Severity: HIGH.

CVE-2020-1108

GHSA-rh58-r7jh-xhx3: Vulnerability

.NET Core Elevation of Privilege Vulnerability

Published 2022-10-25.

Updated 2024-12-01.

Affected ranges: introduced 3.1.0, fixed 3.1.18; introduced 5.0.0, fixed 5.0.9.

Fix versions reported by the advisory: 3.1.18, 5.0.9.

Severity: HIGH.

CVE-2021-26423

GHSA-3gp9-h8hw-pxpw: Vulnerability

Denial of service in .NET core

Published 2022-05-24.

Updated 2024-11-29.

Reported affected releases: 3.1.0, 3.1.1, 3.1.10, 3.1.11, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 5.0.0, 5.0.1, 5.0.2.

Affected ranges: introduced 3.1.0, fixed 3.1.12; introduced 5.0.0, fixed 5.0.3.

Fix versions reported by the advisory: 3.1.12, 5.0.3.

Severity: MEDIUM.

CVE-2021-1721

GHSA-5fxj-whcv-crrc: Vulnerability

Microsoft Security Advisory CVE-2024-21392: .NET Denial of Service Vulnerability

Published 2024-03-12.

Updated 2025-09-04.

Reported affected releases: 7.0.0, 7.0.1, 7.0.10, 7.0.11, 7.0.12, 7.0.13, 7.0.14, 7.0.15, 7.0.16, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.7, 7.0.8, 7.0.9, 8.0.0, 8.0.1, 8.0.2.

Affected ranges: introduced 7.0.0-preview.1.22076.8, fixed 7.0.17; introduced 8.0.0, fixed 8.0.3.

Fix versions reported by the advisory: 7.0.17, 8.0.3.

Severity: HIGH.

CVE-2024-21392

GHSA-8f7f-vqg5-jrv9: Vulnerability

.NET Denial of Service Vulnerability

Published 2023-01-10.

Updated 2025-09-04.

Reported affected releases: 6.0.0, 6.0.1, 6.0.10, 6.0.11, 6.0.12, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9.

Affected ranges: introduced 6.0.0, fixed 6.0.13.

Fix versions reported by the advisory: 6.0.13.

Severity: HIGH.

CVE-2023-21538

GHSA-555c-2p6r-68mm: Vulnerability

.NET Denial of Service vulnerability

Published 2023-06-14.

Updated 2024-07-30.

Affected ranges: introduced 6.0.0, fixed 6.0.18; introduced 7.0.0, fixed 7.0.7.

Fix versions reported by the advisory: 6.0.18, 7.0.7.

Severity: HIGH.

CVE-2023-29331

GHSA-vgwq-hfqc-58wv: Vulnerability

.NET Core Information Disclosure Vulnerability

Published 2022-10-20.

Updated 2024-12-06.

Affected ranges: introduced 3.1.0, fixed 3.1.18; introduced 5.0.0, fixed 5.0.9.

Fix versions reported by the advisory: 3.1.18, 5.0.9.

Severity: MEDIUM.

CVE-2021-34485

GHSA-c6w8-7mp3-34j9: Vulnerability

.NET Remote Code Execution Vulnerability

Published 2022-10-18.

Updated 2026-06-08.

Affected ranges: introduced 3.0.0, fixed 3.1.23; introduced 5.0.0, fixed 5.0.15; introduced 6.0.0, fixed 6.0.3.

Fix versions reported by the advisory: 3.1.23, 5.0.15, 6.0.3.

Severity: MEDIUM.

CVE-2022-24512

GHSA-jx7q-xxmw-44vf: Vulnerability

.NET Elevation of Privilege Vulnerability

Published 2023-06-14.

Updated 2024-11-29.

Affected ranges: introduced 7.0.0, fixed 7.0.7; introduced 6.0.0, fixed 6.0.18.

Fix versions reported by the advisory: 7.0.7, 6.0.18.

Severity: HIGH.

CVE-2023-24936

GHSA-7fcr-8qw6-92fr: Vulnerability

Microsoft Security Advisory CVE-2024-30045 | .NET Remote code Execution Vulnerability

Published 2024-05-14.

Updated 2025-09-04.

Affected ranges: introduced 7.0.0, fixed 7.0.19; introduced 8.0.0, fixed 8.0.5.

Fix versions reported by the advisory: 7.0.19, 8.0.5.

Severity: MEDIUM.

CVE-2024-30045

GHSA-m93f-wj8c-rp8p: Vulnerability

Microsoft Security Advisory CVE-2026-62901 – .NET Denial of Service Vulnerability

Published 2026-08-11.

Updated 2026-08-17.

Affected ranges: introduced 10.0.0, fixed 10.0.11; introduced 9.0.0, fixed 9.0.19; introduced 8.0.0, fixed 8.0.30.

Fix versions reported by the advisory: 10.0.11, 9.0.19, 8.0.30.

Severity: HIGH.

CVE-2026-62901

GHSA-3qf9-qxfj-4whc: Vulnerability

Microsoft Security Advisory CVE-2023-36792: .NET Remote Code Execution Vulnerability

Published 2023-09-12.

Updated 2024-12-03.

Affected ranges: introduced 7.0.0, fixed 7.0.11; introduced 6.0.0, fixed 6.0.22.

Fix versions reported by the advisory: 7.0.11, 6.0.22.

Severity: HIGH.

CVE-2023-36792

GHSA-38fq-h5hc-gwv8: Vulnerability

Microsoft Security Advisory CVE-2023-36794: .NET Remote Code Execution Vulnerability

Published 2023-09-12.

Updated 2024-12-03.

Affected ranges: introduced 7.0.0, fixed 7.0.11; introduced 6.0.0, fixed 6.0.22.

Fix versions reported by the advisory: 7.0.11, 6.0.22.

Severity: HIGH.

CVE-2023-36794

GHSA-g4p8-g7mq-wpx4: Vulnerability

Microsoft Security Advisory CVE-2023-36793: .NET Remote Code Execution Vulnerability

Published 2023-09-12.

Updated 2024-12-03.

Affected ranges: introduced 7.0.0, fixed 7.0.11; introduced 6.0.0, fixed 6.0.22.

Fix versions reported by the advisory: 7.0.11, 6.0.22.

Severity: HIGH.

CVE-2023-36793

GHSA-h7jm-g87p-5935: Vulnerability

Microsoft Security Advisory CVE-2023-36796: .NET Remote Code Execution Vulnerability

Published 2023-09-12.

Updated 2024-12-03.

Affected ranges: introduced 7.0.0, fixed 7.0.11; introduced 6.0.0, fixed 6.0.22.

Fix versions reported by the advisory: 7.0.11, 6.0.22.

Severity: HIGH.

CVE-2023-36796

GHSA-3rxq-g8rj-r2cf: Vulnerability

Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 9.0.0, fixed 9.0.21; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2; introduced 10.0.0, fixed 10.0.13; introduced 8.0.0, fixed 8.0.32.

Fix versions reported by the advisory: 9.0.21, 11.0.0-rc.2, 10.0.13, 8.0.32.

Severity: HIGH.

CVE-2026-69651

GHSA-mc4q-93x5-f6hj: Vulnerability

Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 9.0.0, fixed 9.0.21; introduced 8.0.0, fixed 8.0.32; introduced 10.0.0, fixed 10.0.13; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2.

Fix versions reported by the advisory: 9.0.21, 8.0.32, 10.0.13, 11.0.0-rc.2.

Severity: HIGH.

CVE-2026-58280

GHSA-c494-m2fq-59mx: Vulnerability

Microsoft Security Advisory CVE-2026-62898 – .NET Information Disclosure Vulnerability

Published 2026-08-11.

Updated 2026-08-17.

Affected ranges: introduced 10.0.0, fixed 10.0.11; introduced 9.0.0, fixed 9.0.19; introduced 8.0.0, fixed 8.0.30.

Fix versions reported by the advisory: 10.0.11, 9.0.19, 8.0.30.

Severity: HIGH.

CVE-2026-62898

GHSA-x469-cv7m-77r9: Vulnerability

.NET Remote Code Execution Vulnerability

Published 2023-06-14.

Updated 2024-07-30.

Reported affected releases: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5.

Affected ranges: introduced 7.0.0, fixed 7.0.7.

Fix versions reported by the advisory: 7.0.7.

Severity: HIGH.

CVE-2023-33128

GHSA-87vj-4hqv-22p9: Vulnerability

Microsoft Security Advisory CVE-2026-96233 - .NET and Visual Studio Denial of Service Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 10.0.0, fixed 10.0.13; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2; introduced 9.0.0, fixed 9.0.21; introduced 8.0.0, fixed 8.0.32.

Fix versions reported by the advisory: 10.0.13, 11.0.0-rc.2, 9.0.21, 8.0.32.

Severity: HIGH.

CVE-2026-96233

GHSA-4mpw-cpwj-hxxj: Vulnerability

Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 8.0.0, fixed 8.0.32; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2; introduced 9.0.0, fixed 9.0.21; introduced 10.0.0, fixed 10.0.13.

Fix versions reported by the advisory: 8.0.32, 11.0.0-rc.2, 9.0.21, 10.0.13.

Severity: HIGH.

CVE-2026-70197

GHSA-wxxw-5cvc-53j7: Vulnerability

Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 9.0.0, fixed 9.0.21; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2; introduced 10.0.0, fixed 10.0.13; introduced 8.0.0, fixed 8.0.32.

Fix versions reported by the advisory: 9.0.21, 11.0.0-rc.2, 10.0.13, 8.0.32.

Severity: MEDIUM.

CVE-2026-66822

GHSA-5v8v-66v8-mwm7: Vulnerability

Integer overflow in the bundled Brotli C library

Published 2022-05-24.

Updated 2026-09-10.

Affected ranges: introduced 3.0.0, fixed 3.1.23; introduced 5.0.0, fixed 5.0.15; introduced 6.0.0, fixed 6.0.3.

Fix versions reported by the advisory: 3.1.23, 5.0.15, 6.0.3.

Severity: CRITICAL.

CVE-2020-36846

Source: OSV, including OpenSSF malicious-package reports and GitHub advisories. No known report is not proof a package is safe.