NuGet Advisories.

Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability

• Memory corruption
• CWE-20

>=8.0.0, <8.0.27 || >=9.0.0, <9.0.16 || >=10.0.0, <10.0.8 · fixed in 8.0.27, 9.0.16, 10.0.8

Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability

• Denial of service

>=8.0.0, <8.0.27 || >=9.0.0, <9.0.16 || >=10.0.0, <10.0.8 · fixed in 8.0.27, 9.0.16, 10.0.8

Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability

• Path traversal

>=8.0.0, <8.0.27 || >=9.0.0, <9.0.16 || >=10.0.0, <10.0.8 · fixed in 8.0.27, 9.0.16, 10.0.8

ImageMagick: Policy Bypass in PSD decoder

• Denial of service

<14.13.1 · fixed in 14.13.1

ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

• Memory corruption
• CWE-193

<14.13.1 · fixed in 14.13.1

ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define

• Memory corruption
• CWE-129

<14.13.1 · fixed in 14.13.1

Microsoft DirectX12: .spritefont multiply overflow only in 32-bit builds

• Memory corruption

<2026.5.8.1 · fixed in 2026.5.8.1

Microsoft DirectX: .spritefont multiply overflow only in 32-bit builds

• Memory corruption

<2026.5.8.1 · fixed in 2026.5.8.1

ImageMagick: Heap Buffer Over-Read in IPTC encoder

• Memory corruption

<14.13.1 · fixed in 14.13.1

Marten has an injection vulnerability in its full-text search regConfig parameter

• Other injection
• SQL injection

<8.37.0 · fixed in 8.37.0

oxidize-pdf: NaN/inf bypass in colour content-stream emission causes PDF rejection (DoS)

• CWE-20
• CWE-1284

<2.6.0 · fixed in 2.6.0

SharpCompress has directory traversal via directory entries in WriteToDirectory (zip slip variant)

• Path traversal

<0.48.0 · fixed in 0.48.0

OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured

• Weak cryptography or TLS

<1.1.0 · fixed in 1.1.0

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

• Open redirect

<1.9.1 · fixed in 1.9.1

Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException

• Denial of service

<1.1.62 · fixed in 1.1.62

Snappier has an infinite loop during SnappyStream decompression with malformed framed input

• Denial of service

<1.3.1 · fixed in 1.3.1

OpAMP client reads unbounded HTTP response bodies

• Denial of service

<0.2.0-alpha.1 · fixed in 0.2.0-alpha.1

YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers

• Cross-site scripting (XSS)
• CWE-116

<3.2.12 || >=4.0.0-beta01, <4.0.5 · fixed in 3.2.12, 4.0.5

YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`

• SQL injection
• CWE-841

<4.0.5 · fixed in 4.0.5

YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

• Cross-site scripting (XSS)
• CWE-116

<3.2.12 || >=4.0.0-beta01, <4.0.5 · fixed in 3.2.12, 4.0.5

OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter

• CWE-379

>=1.8.0, <1.15.3 · fixed in 1.15.3

OneCollector exporter reads unbounded HTTP response bodies

• Denial of service

<1.15.1 · fixed in 1.15.1

OpenTelemetry.Resources.Azure has an unbounded HTTP response body read

• Denial of service

<1.15.1-beta.1 · fixed in 1.15.1-beta.1

OpenTelemetry's Zipkin remote endpoint cache could grow without bounds and increase memory pressure

• Denial of service

<1.15.3 · fixed in 1.15.3

ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width

• Denial of service

>=18.1.0, <23.0.0.1 · fixed in 23.0.0.1

OpenTelemetry.Sampler.AWS & OpenTelemetry.Resources.AWS have unbounded HTTP response body reads

• Denial of service

<0.1.0-alpha.8 · fixed in 0.1.0-alpha.8

OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

• Denial of service

>=0.5.0-beta.2, <1.15.3 · fixed in 1.15.3

OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling

• Denial of service

>=1.13.1, <1.15.3 · fixed in 1.15.3

OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies

• Denial of service

>=1.13.1, <1.15.2 · fixed in 1.15.2

Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege

• Weak cryptography or TLS

>=10.0.0, <10.0.7 · fixed in 10.0.7

OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle

• Denial of service

<3.1.3 · fixed in 3.1.3

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

• Other injection

<4.16.0 · fixed in 4.16.0

OpenTelemetry .NET has potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path

• Denial of service

<=1.6.0-rc.1 · no fixed version yet

Zio has SubFileSystem Path Confinement Bypass via Unresolved `..` Segment

• Path traversal
• CWE-179

<0.22.2 · fixed in 0.22.2

Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)

• Information disclosure
• Denial of service

>=2.0.0, <2.1.1 · fixed in 2.1.1

ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents

• Denial of service

<12.22.7 || >=13.0.0, <13.9.16 || >=14.0.0, <14.3.1 || >=15.0.0, <15.1.14 · fixed in 12.22.7, 13.9.16, 14.3.1, 15.1.14

MsQuic has a Remote Elevation of Privilege Vulnerability

• Memory corruption

<2.4.18 || >=2.5.0-ci.532574, <2.5.7 · fixed in 2.4.18, 2.5.7

Defense in Depth update for NuGet Client

• CWE-345

>=4.9.0, <4.9.7 || >=5.11.0, <5.11.7 || >=6.8.0, <6.8.2 || >=6.11.0, <6.11.2 || >=6.12.0, <6.12.5 || >=6.14.0, <6.14.3 || >=7.0.0, <7.0.3 || >=7.3.0, <7.3.1 · fixed in 4.9.7, 5.11.7, 6.8.2, 6.11.2, 6.12.5, 6.14.3, 7.0.3, 7.3.1

Kiota: Code Generation Literal Injection

• Code injection

<1.29.1 || >=1.30.0, <1.31.1 · fixed in 1.29.1, 1.31.1

DotNetNuke.Core security code analysis rules triggered

>=6.0.0, <10.2.2 · fixed in 10.2.2

ImageMagick has a memory leak in PNG encoder when writing a MNG image

• Denial of service

<14.12.0 · fixed in 14.12.0

ImageMagick has out-of-bounds access in ConnectedComponentsImage() via CLI-controlled connected-components:* artifacts

• Memory corruption

<14.12.0 · fixed in 14.12.0

ImageMagick has a heap buffer overflow read in magnify operation via unrecognized magnify:method value

• Memory corruption

<14.12.0 · fixed in 14.12.0

ImageMagick has has a stack-buffer-overflow in MNG encoder with oversized pallete

• Memory corruption

<14.12.0 · fixed in 14.12.0

ImageMagick has has an off-by-one origin validation in allows out-of-bounds read in morphology processing

• Memory corruption
• CWE-193

<14.12.0 · fixed in 14.12.0

ImageMagick has a heap-buffer-overflow in FTXT encoder

• Memory corruption

<14.12.0 · fixed in 14.12.0

Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability

• Denial of service
• XML external entities (XXE)

>=8.0.0, <8.0.3 || >=9.0.0, <9.0.15 || >=10.0.0, <10.0.6 · fixed in 8.0.3, 9.0.15, 10.0.6

Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

• Denial of service
• CWE-20

>=8.0.0, <8.0.3 || >=9.0.0, <9.0.15 || >=10.0.0, <10.0.6 · fixed in 8.0.3, 9.0.15, 10.0.6

Microsoft Security Advisory CVE-2026-32178 – .NET Spoofing Vulnerability

• CWE-138

>=8.0.0, <8.0.26 || >=9.0.0, <9.0.15 || >=10.0.0, <10.0.6 · fixed in 8.0.26, 9.0.15, 10.0.6

ImageMagick has an off-by-one error in MSL decoder could result in crash

• CWE-193

<14.12.0 · fixed in 14.12.0

ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

• Memory corruption
• CWE-693

<14.12.0 · fixed in 14.12.0

ImageMagick has a heap out-of-bounds write in JP2 encoder

• Memory corruption

<14.12.0 · fixed in 14.12.0

ImageMagick has a heap buffer overflow when encoding JXL image with a 16-bit float

• Memory corruption

<14.12.0 · fixed in 14.12.0

ImageMagick has a heap buffer overflow (WRITE) in the YAML and JSON encoders.

• Memory corruption

<14.12.0 · fixed in 14.12.0

ImageMagick has an out-of-bounds read in sample operation

• Memory corruption

<14.12.0 · fixed in 14.12.0

ImageMagick has a Stack Overflow via Recursive FX Expression Parsing

• Denial of service

<14.12.0 · fixed in 14.12.0

ImageMagick has a heap Buffer Overflow in ImageMagick MVG decoder

• Memory corruption

<14.12.0 · fixed in 14.12.0

ImageMagick has a Stack Overflow in DestroyXMLTree()

• Denial of service

<14.12.0 · fixed in 14.12.0

ImageMagick has a heap-Buffer-Overflow write of a single zero byte when parsing xml.

• Memory corruption

<14.12.0 · fixed in 14.12.0

ImageMagick has an integer overflow in despeckle operation causing a heap buffer overflow on 32-bit builds

• Memory corruption

<14.12.0 · fixed in 14.12.0