Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet)

Known vulnerabilities and malicious package reports for Microsoft.WindowsDesktop.App.Runtime.win-x64 on NuGet, live from OSV, with CISA KEV exploitation status and EPSS scores.

Known package reports

0 malicious package reports and 24 vulnerabilities returned by OSV. Check a specific version to see which reports apply.

GHSA-r4mw-gxf7-vxr9: Vulnerability

Remote code execution in Microsoft.WindowsDesktop.App.Ref

Published 2022-05-24.

Updated 2023-11-08.

Reported affected releases: 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.1.10, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9.

Affected ranges: introduced 3.0.0, fixed 3.0.2; introduced 3.1.0, fixed 3.1.11.

Fix versions reported by the advisory: 3.0.2, 3.1.11.

Severity: HIGH.

CVE-2020-0606

GHSA-gh2h-rhph-h37g: Vulnerability

Microsoft Security Advisory CVE-2026-50646 – .NET Remote Code Execution Vulnerability

Published 2026-09-08.

Updated 2026-09-08.

Affected ranges: introduced 10.0.0, fixed 10.0.10; introduced 9.0.0, fixed 9.0.18; introduced 8.0.0, fixed 8.0.29.

Fix versions reported by the advisory: 10.0.10, 9.0.18, 8.0.29.

Severity: HIGH.

CVE-2026-50646

GHSA-6qmx-42h2-j8h6: Vulnerability

.NET Elevation of Privilege Vulnerability

Published 2024-04-17.

Updated 2025-09-04.

Affected ranges: introduced 0, fixed 6.0.29; introduced 8.0.0, fixed 8.0.4; introduced 7.0.0, fixed 7.0.18.

Fix versions reported by the advisory: 6.0.29, 8.0.4, 7.0.18.

Severity: HIGH.

CVE-2024-21409

GHSA-485r-rp8v-998v: Vulnerability

Microsoft Security Advisory CVE-2023-33127: .NET Remote Code Execution Vulnerability

Published 2023-07-11.

Updated 2024-06-03.

Affected ranges: introduced 7.0.0, fixed 7.0.9; introduced 6.0.0, fixed 6.0.20.

Fix versions reported by the advisory: 7.0.9, 6.0.20.

Severity: HIGH.

CVE-2023-33127

GHSA-4j9v-h7pp-725h: Vulnerability

Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 10.0.0, fixed 10.0.13; introduced 8.0.0, fixed 8.0.32; introduced 9.0.0, fixed 9.0.21; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2.

Fix versions reported by the advisory: 10.0.13, 8.0.32, 9.0.21, 11.0.0-rc.2.

Severity: HIGH.

CVE-2026-70035

GHSA-4w5f-7jp2-w48g: Vulnerability

Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 11.0.0-preview.1, fixed 11.0.0-rc.2; introduced 10.0.0, fixed 10.0.13; introduced 8.0.0, fixed 8.0.32; introduced 9.0.0, fixed 9.0.21.

Fix versions reported by the advisory: 11.0.0-rc.2, 10.0.13, 8.0.32, 9.0.21.

Severity: HIGH.

CVE-2026-83520

GHSA-2c7v-qcjp-4mg2: Vulnerability

.NET Remote Code Execution Vulnerability

Published 2022-12-14.

Updated 2025-01-03.

Affected ranges: introduced 3.1.0, fixed 3.1.32; introduced 6.0.0, fixed 6.0.12; introduced 7.0.0, fixed 7.0.1.

Fix versions reported by the advisory: 3.1.32, 6.0.12, 7.0.1.

Severity: HIGH.

CVE-2022-41089

GHSA-jh2h-qcrw-ghg7: Vulnerability

.NET Remote Code Execution Vulnerability

Published 2023-06-14.

Updated 2024-12-03.

Affected ranges: introduced 7.0.0, fixed 7.0.7; introduced 6.0.0, fixed 6.0.18.

Fix versions reported by the advisory: 7.0.7, 6.0.18.

Severity: HIGH.

CVE-2023-24895

GHSA-9mrh-pw7c-9mqm: Vulnerability

Microsoft Security Advisory CVE-2026-62902 – .NET Information Disclosure Vulnerability

Published 2026-08-11.

Updated 2026-08-17.

Affected ranges: introduced 10.0.0, fixed 10.0.11; introduced 9.0.0, fixed 9.0.19; introduced 8.0.0, fixed 8.0.30.

Fix versions reported by the advisory: 10.0.11, 9.0.19, 8.0.30.

Severity: MEDIUM.

CVE-2026-62902

GHSA-c27m-942f-rcfh: Vulnerability

Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 9.0.0, fixed 9.0.21; introduced 8.0.0, fixed 8.0.32; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2; introduced 10.0.0, fixed 10.0.13.

Fix versions reported by the advisory: 9.0.21, 8.0.32, 11.0.0-rc.2, 10.0.13.

Severity: HIGH.

CVE-2026-87697

GHSA-5qr9-xxm9-6cmq: Vulnerability

Microsoft Security Advisory CVE-2026-96229 - .NET and Visual Studio Information Disclosure Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 9.0.0, fixed 9.0.21; introduced 10.0.0, fixed 10.0.13; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2; introduced 8.0.0, fixed 8.0.32.

Fix versions reported by the advisory: 9.0.21, 10.0.13, 11.0.0-rc.2, 8.0.32.

Severity: MEDIUM.

CVE-2026-96229

GHSA-f749-vhgx-39h6: Vulnerability

Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 8.0.0, fixed 8.0.32; introduced 9.0.0, fixed 9.0.21; introduced 10.0.0, fixed 10.0.13; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2.

Fix versions reported by the advisory: 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2.

Severity: HIGH.

CVE-2026-70174

GHSA-xq57-crx4-g373: Vulnerability

Microsoft Security Advisory CVE-2026-96224 - .NET and Visual Studio Remote Code Execution Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 10.0.0, fixed 10.0.13; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2; introduced 8.0.0, fixed 8.0.32; introduced 9.0.0, fixed 9.0.21.

Fix versions reported by the advisory: 10.0.13, 11.0.0-rc.2, 8.0.32, 9.0.21.

Severity: HIGH.

CVE-2026-96224

GHSA-f63g-mx39-3r38: Vulnerability

Microsoft Security Advisory CVE-2026-85363 - .NET and Visual Studio Remote Code Execution Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 8.0.0, fixed 8.0.32; introduced 10.0.0, fixed 10.0.13; introduced 9.0.0, fixed 9.0.21; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2.

Fix versions reported by the advisory: 8.0.32, 10.0.13, 9.0.21, 11.0.0-rc.2.

Severity: HIGH.

CVE-2026-85363

GHSA-g44w-h65v-4cw9: Vulnerability

Microsoft Security Advisory CVE-2026-96235 - .NET and Visual Studio Remote Code Execution Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 8.0.0, fixed 8.0.32; introduced 10.0.0, fixed 10.0.13; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2; introduced 9.0.0, fixed 9.0.21.

Fix versions reported by the advisory: 8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21.

Severity: HIGH.

CVE-2026-96235

GHSA-f8qh-mqg4-9939: Vulnerability

Microsoft Security Advisory CVE-2026-96232 - .NET and Visual Studio Information Disclosure Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 11.0.0-preview.1, fixed 11.0.0-rc.2; introduced 9.0.0, fixed 9.0.21; introduced 8.0.0, fixed 8.0.32; introduced 10.0.0, fixed 10.0.13.

Fix versions reported by the advisory: 11.0.0-rc.2, 9.0.21, 8.0.32, 10.0.13.

Severity: HIGH.

CVE-2026-96232

GHSA-pfwj-2f93-rf42: Vulnerability

Microsoft Security Advisory CVE-2026-70007 - .NET and Visual Studio Remote Code Execution Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 9.0.0, fixed 9.0.21; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2; introduced 10.0.0, fixed 10.0.13; introduced 8.0.0, fixed 8.0.32.

Fix versions reported by the advisory: 9.0.21, 11.0.0-rc.2, 10.0.13, 8.0.32.

Severity: HIGH.

CVE-2026-70007

GHSA-8x9c-mqxv-q2pp: Vulnerability

Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability

Published 2026-05-18.

Updated 2026-07-08.

Affected ranges: introduced 8.0.0, fixed 8.0.27; introduced 9.0.0, fixed 9.0.16; introduced 10.0.0, fixed 10.0.8.

Fix versions reported by the advisory: 8.0.27, 9.0.16, 10.0.8.

Severity: HIGH.

CVE-2026-35433

GHSA-vg44-h755-9hw7: Vulnerability

Microsoft Security Advisory CVE-2026-62871 – .NET Elevation of Privilege Vulnerability

Published 2026-08-11.

Updated 2026-08-17.

Affected ranges: introduced 10.0.0, fixed 10.0.11; introduced 9.0.0, fixed 9.0.19; introduced 8.0.0, fixed 8.0.30.

Fix versions reported by the advisory: 10.0.11, 9.0.19, 8.0.30.

Severity: HIGH.

CVE-2026-62871

GHSA-jqhp-238x-qhgf: Vulnerability

Microsoft Security Advisory CVE-2026-62886 – .NET Elevation of Privilege Vulnerability

Published 2026-08-11.

Updated 2026-08-17.

Affected ranges: introduced 10.0.0, fixed 10.0.11; introduced 9.0.0, fixed 9.0.19; introduced 8.0.0, fixed 8.0.30.

Fix versions reported by the advisory: 10.0.11, 9.0.19, 8.0.30.

Severity: HIGH.

CVE-2026-62886

GHSA-2969-4q4w-w5h3: Vulnerability

Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability

Published 2026-07-21.

Updated 2026-07-27.

Affected ranges: introduced 10.0.0, fixed 10.0.10; introduced 9.0.0, fixed 9.0.18; introduced 8.0.0, fixed 8.0.29.

Fix versions reported by the advisory: 10.0.10, 9.0.18, 8.0.29.

Severity: HIGH.

CVE-2026-50650

GHSA-fx4q-gjrx-2jw6: Vulnerability

Microsoft Security Advisory CVE-2026-62897 – .NET Remote Code Execution Vulnerability

Published 2026-08-11.

Updated 2026-08-17.

Affected ranges: introduced 10.0.0, fixed 10.0.11; introduced 9.0.0, fixed 9.0.19; introduced 8.0.0, fixed 8.0.30.

Fix versions reported by the advisory: 10.0.11, 9.0.19, 8.0.30.

Severity: HIGH.

CVE-2026-62897

GHSA-gg8c-3338-xw2f: Vulnerability

Microsoft Security Advisory CVE-2026-70354 – .NET Core Remote Code Execution Vulnerability

Published 2026-08-11.

Updated 2026-08-18.

Affected ranges: introduced 10.0.0, fixed 10.0.11; introduced 9.0.0, fixed 9.0.19; introduced 8.0.0, fixed 8.0.30.

Fix versions reported by the advisory: 10.0.11, 9.0.19, 8.0.30.

Severity: HIGH.

CVE-2026-70354

GHSA-fq6x-pvr9-888r: Vulnerability

Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability

Published 2026-10-13.

Updated 2026-10-13.

Affected ranges: introduced 9.0.0, fixed 9.0.21; introduced 10.0.0, fixed 10.0.13; introduced 8.0.0, fixed 8.0.32; introduced 11.0.0-preview.1, fixed 11.0.0-rc.2.

Fix versions reported by the advisory: 9.0.21, 10.0.13, 8.0.32, 11.0.0-rc.2.

Severity: MEDIUM.

CVE-2026-96234

Source: OSV, including OpenSSF malicious-package reports and GitHub advisories. No known report is not proof a package is safe.