CVE-2026-114157

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.App.Runtime.win-arm64 versions 8.0.0-preview.1.23112.2 through 8.0.33 Microsoft.AspNetCore.App.Runtime.win-x64 versions 8.0.0-preview.1.23112.2 through 8.0.33 Microsoft.AspNetCore.App.Runtime.win-x86 versions 8.0.0-preview.1.23112.2 through 8.0.33 Microsoft.AspNetCore.App.Runtime.win-arm64 versions 9.0.0-preview.1.24081.5 through 9.0.22 Microsoft.AspNetCore.App.Runtime.win-x64 versions 9.0.0-preview.1.24081.5 through 9.0.22 Microsoft.AspNetCore.App.Runtime.win-x86 versions 9.0.0-preview.1.24081.5 through 9.0.22 Microsoft.AspNetCore.App.Runtime.win-arm64 versions 10.0.0-preview.1.25120.3 through 10.0.14 Microsoft.AspNetCore.App.Runtime.win-x64 versions 10.0.0-preview.1.25120.3 through 10.0.14 Microsoft.AspNetCore.App.Runtime.win-x86 versions 10.0.0-preview.1.25120.3 through 10.0.14 Microsoft.AspNetCore.App.Runtime.win-arm64 versions 11.0.0-preview.1.26104.118 through 11.0.0-rc.3.26522.148 Microsoft.AspNetCore.App.Runtime.win-x64 versions 11.0.0-preview.1.26104.118 through 11.0.0-rc.3.26522.148 Microsoft.AspNetCore.App.Runtime.win-x86 versions 11.0.0-preview.1.26104.118 through 11.0.0-rc.3.26522.148

Description A race condition occurs in ASP.NET Core when using shared resources with improper synchronization, which allows an authorized attacker to elevate privileges locally. Specifically, in the Kestrel Named Pipes transport, a listener configured with CurrentUserOnly can lose protected namespace ownership during recovery. This allows another local user to claim the pipe path and bypass security features.

Recommendations Update Microsoft.AspNetCore.App.Runtime.win-arm64 to version 8.0.34 Update Microsoft.AspNetCore.App.Runtime.win-x64 to version 8.0.34 Update Microsoft.AspNetCore.App.Runtime.win-x86 to version 8.0.34 Update Microsoft.AspNetCore.App.Runtime.win-arm64 to version 9.0.23 Update Microsoft.AspNetCore.App.Runtime.win-x64 to version 9.0.23 Update Microsoft.AspNetCore.App.Runtime.win-x86 to version 9.0.23 Update Microsoft.AspNetCore.App.Runtime.win-arm64 to version 10.0.15 Update Microsoft.AspNetCore.App.Runtime.win-x64 to version 10.0.15 Update Microsoft.AspNetCore.App.Runtime.win-x86 to version 10.0.15 Update Microsoft.AspNetCore.App.Runtime.win-arm64 to version 11.0.0 Update Microsoft.AspNetCore.App.Runtime.win-x64 to version 11.0.0 Update Microsoft.AspNetCore.App.Runtime.win-x86 to version 11.0.0