CVE-2026-35433: Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability

May 18, 2026

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.

References

github.com/advisories/GHSA-8x9c-mqxv-q2pp
github.com/dotnet/announcements/issues/398
github.com/dotnet/wpf/security/advisories/GHSA-8x9c-mqxv-q2pp
msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35433
nvd.nist.gov/vuln/detail/CVE-2026-35433

Code Behaviors & Features

Detect and mitigate CVE-2026-35433 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →