CVE-2026-114155

Name of the Vulnerable Software and Affected Versions .NET SDK (dotnet-watch) versions 10.0.300 through 10.0.303 .NET SDK (dotnet-watch) versions 10.0.400 through 10.0.403 .NET SDK (dotnet-watch) versions 11.0.100-preview.3.26207.106 through 11.0.100-rc.3.26522.148 Microsoft.DotNet.HotReload.Watch.Aspire versions 10.0.300 through 10.0.303 Microsoft.DotNet.HotReload.Watch.Aspire versions 10.0.400 through 10.0.403 Microsoft.DotNet.HotReload.Watch.Aspire versions 11.0.100-preview.3.26207.106 through 11.0.100-rc.3.26522.148

Description A time-of-check time-of-use (toctou) race condition exists in the dotnet-watch component of the .NET SDK. A toctou race condition occurs when a program checks the state of a resource and then acts upon that resource, but the state changes between the check and the action. This flaw allows an authorized local attacker to replace or modify a temporary solution file used by dotnet-watch, which can lead to the alteration of a subsequent build and local privilege elevation. This issue affects Linux and macOS platforms.

Recommendations Update .NET SDK (dotnet-watch) versions 10.0.300 through 10.0.303 to version 10.0.404. Update .NET SDK (dotnet-watch) versions 10.0.400 through 10.0.403 to version 10.0.404. Update .NET SDK (dotnet-watch) versions 11.0.100-preview.3.26207.106 through 11.0.100-rc.3.26522.148 to version 11.0.100. Update Microsoft.DotNet.HotReload.Watch.Aspire versions 10.0.300 through 10.0.303 to version 10.0.404. Update Microsoft.DotNet.HotReload.Watch.Aspire versions 10.0.400 through 10.0.403 to version 10.0.404. Update Microsoft.DotNet.HotReload.Watch.Aspire versions 11.0.100-preview.3.26207.106 through 11.0.100-rc.3.26522.148 to version 11.0.100.