Microsoft .NET Runtime: Heap-based buffer overflow in Microsoft.NETCore.App.Runtime.win-x86 (CVE-2026-114158)

Microsoft has disclosed a heap-based buffer overflow vulnerability (CVE-2026-114158) impacting the Microsoft.NETCore.App.Runtime.win-x86 package. The flaw exists in versions 8.0.0 through 8.0.33. An unauthorized remote attacker could trigger this vulnerability to execute arbitrary code, though successful exploitation requires user interaction. This advisory was flagged as a duplicate of GHSA-r8h3-p8p6-ggp7 in the GitHub Advisory Database.

Impact

Successful exploitation could result in full loss of confidentiality, integrity, and availability of the affected system, as the vulnerability allows for remote code execution.

Recommendation

• Inventory all environments utilizing the Microsoft.NETCore.App.Runtime.win-x86 NuGet package to identify instances within the vulnerable range (8.0.0 to 8.0.33).
• Review the Microsoft Security Update Guide for CVE-2026-114158 for guidance on the required patches or updated runtime versions once released by Microsoft.
• Prioritize systems that ingest untrusted or externally sourced network content where user interaction is common.