Microsoft .NETCore.App.Runtime: Heap-based buffer overflow in CVE-2026-114159
A heap-based buffer overflow vulnerability in Microsoft .NETCore.App.Runtime.win-x86 allows for remote code execution via network-based exploitation requiring user interaction.
CVE search metadata
CVE search record: CVE-2026-114159. Severity: high. CVSS: 8.8. KEV: no. Product: Microsoft.NETCore.App.Runtime.win-x86 (>= 8.0.0, < 8.0.34). Brief: Microsoft .NETCore.App.Runtime: Heap-based buffer overflow in CVE-2026-114159. Brief link: https://feed.craftedsignal.io/briefs/2026-11-microsoft-netcore-heap-overflow-b20bbb4c/
Triage facts
Revision 1- Applicability
- Microsoft.NETCore.App.Runtime.win-x86 (>= 8.0.0, < 8.0.34)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 11, 01:54 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
Microsoft .NETCore.App.Runtime.win-x86 (versions 8.0.0 through 8.0.33) is susceptible to a heap-based buffer overflow (CWE-122) which could allow an unauthorized attacker to achieve remote code execution. This advisory, originally associated with CVE-2026-114159, has been withdrawn by GitHub as a duplicate of GHSA-3cgx-w6gm-fqrx.
Impact
Successful exploitation allows for remote code execution with high confidentiality, integrity, and availability impact. Exploitation requires user interaction.
Recommendation
- Inventory systems utilizing the Microsoft.NETCore.App.Runtime.win-x86 package for versions within the affected range (>= 8.0.0, < 8.0.34).
- Monitor official Microsoft security update channels for the superseding advisory (GHSA-3cgx-w6gm-fqrx) to determine the corrective patch release.
- Implement network-level egress filtering to restrict unauthorized external connections from systems running critical .NET runtime applications.
Immediate actions
Inventory .NET core runtime environments to identify versions < 8.0.34.
Threat Hunt
Monitor for anomalous process execution patterns originating from processes hosting .NET runtime applications, particularly those involving network-received payloads.
Data: Process creation telemetry, Network connection telemetry
Mitigations
Await and deploy the patch associated with the canonical advisory GHSA-3cgx-w6gm-fqrx.
CVE-2026-114159