.NET Vulnerabilities Expose Apps to Code Execution and DoS Risks

Ubuntu has issued a security notice addressing multiple critical vulnerabilities in Microsoft's .NET framework. These flaws span across core components including the Blazor WebAssembly debug proxy, the Brotli compression library, and internal file permission handling mechanisms. Exploitation of these issues could result in remote code execution, denial of service, or unauthorized privilege escalation.

The most severe flaw involves an incomplete fix previously released under USN-8942-1, which left .NET applications still vulnerable to injection attacks through improperly escaped values in the Blazor debugging interface. Additional vulnerabilities were identified in low-level libraries and runtime behaviors that further expand the potential attack surface for malicious actors targeting enterprise web applications built on .NET platforms.

Blazor Debug Proxy Flaw Leaves Room for Remote Exploits

• The vulnerability exists due to improper escaping of user-controlled input within the Blazor WebAssembly debug proxy component.
• An unauthenticated attacker could leverage this flaw to inject and execute arbitrary commands on the host system.
• This issue stems from an incomplete remediation effort originally published in USN-8942-1.
• Only dotnet10 and dotnet11 packages are impacted by this specific vulnerability (CVE-2026-102870).

Compression Library and File Handling Defects Broaden Attack Surface

• The Brotli decompression library integrated into .NET fails to validate malformed compressed data streams correctly.
• Remote attackers can exploit this behavior to trigger crashes or potentially achieve arbitrary code execution (CVE-2026-111497).
• A separate issue related to incorrect file ownership management during specific operations allows local users to gain elevated privileges (CVE-2026-114148).
• All three vulnerabilities require immediate patching to protect against active exploitation scenarios.

Sources

• USN-8958-1: .NET vulnerabilities