PT-2026-7332 · Microsoft+4 · .Net 10.0.2+10

Vcsjones · Published 2026-02-10 · Updated 2026-05-08 · CVE-2026-21218

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions .NET versions 8.0.0 through 8.0.22 .NET versions 9.0.0 through 9.0.12 .NET versions 10.0.0 through 10.0.2

Description The software contains a security feature bypass issue due to improper handling of missing special elements. An attacker could exploit this by crafting a malicious payload that bypasses security checks in the affected System.Security.Cryptography.Cose versions, potentially leading to unauthorized access or data manipulation. If an application does not use System.Security.Cryptography.Cose, it is not affected.

Recommendations Update the System.Security.Cryptography.Cose NuGet package to version 8.0.24 for .NET 8.0. Update the System.Security.Cryptography.Cose NuGet package to version 9.0.13 for .NET 9.0. Update the System.Security.Cryptography.Cose NuGet package to version 10.0.3 for .NET 10.0.

Fix

Weakness Enumeration

CWE-166

Related Identifiers

BDU:2026-01775

BIT-DOTNET-2026-21218

BIT-DOTNET-SDK-2026-21218

CVE-2026-21218

GHSA-QVHC-9V3J-5RFW

USN-8025-1

USN-8025-2

Affected Products

.Net 10.0.0

.Net 10.0.2

.Net 8.0.0

.Net 8.0.22

.Net 9.0.0

.Net 9.0.12

Linuxmint

Red Os

System.Security.Cryptography.Cose

System.Security.Cryptography.Cose Nuget Package

Ubuntu

References · 29

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21218 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qvhc-9v3j-5rfw · Vendor Advisory
• https://osv.dev/vulnerability/USN-8025-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8025-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-21218 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21218 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01775 · Security Note
• https://ubuntu.com/security/notices/USN-8025-2 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dotnet-2026-21218 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21218 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8025-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-21218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21218 · Security Note
• https://osv.dev/vulnerability/BIT-dotnet-sdk-2026-21218 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-21218 · Security Note