Skip to content
cve.newCreate a CVE report

Microsoft.NETCore.App.Runtime.osx-arm64

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium5.3
CVE-2026-120796Package fixes recorded

Microsoft Security Advisory CVE-2026-120796 - .NET Denial of Service Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

Recorded fixes — Microsoft.NETCore.App.Runtime.linux-arm: 11.0.0; Microsoft.NETCore.App.Runtime.linux-arm64: 11.0.0; 10 more packages. Check your release branch.

Exploitation not established

NuGet / Microsoft.NETCore.App.Runtime.linux-armNuGet / Microsoft.NETCore.App.Runtime.linux-arm64NuGet / Microsoft.NETCore.App.Runtime.linux-musl-arm
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet
Affected range Recorded fix
From 11.0.0-preview.1.26104.118 before 11.0.0Ecosystem versions11.0.0

Version evidence: OSV · GHSA-cpw3-h88j-9f6x

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "11.0.0-preview.1.26104.118"
        },
        {
          "fixed": "11.0.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": []
}
high7.5
CVE-2026-109475Package fixes recorded

Microsoft Security Advisory CVE-2026-109475 - .NET Denial of Service Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.

Recorded fixes — Microsoft.NETCore.App.Runtime.linux-arm: 8.0.34 or 9.0.23 or 10.0.15 or 11.0.0; Microsoft.NETCore.App.Runtime.linux-arm64: 8.0.34 or 9.0.23 or 10.0.15 or 11.0.0; 6 more packages. Check your release branch.

Exploitation not established

NuGet / Microsoft.NETCore.App.Runtime.linux-armNuGet / Microsoft.NETCore.App.Runtime.linux-arm64NuGet / Microsoft.NETCore.App.Runtime.linux-musl-arm
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet
Affected range Recorded fix
From 8.0.0-0 before 8.0.34Ecosystem versions8.0.34

Version evidence: OSV · GHSA-3g4v-f5gv-c7xf

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "8.0.0-0"
        },
        {
          "fixed": "8.0.34"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "8.0.0",
    "8.0.1",
    "8.0.10",
    "8.0.11",
    "8.0.12",
    "8.0.13",
    "8.0.14",
    "8.0.15",
    "8.0.16",
    "8.0.17",
    "8.0.18",
    "8.0.19",
    "8.0.2",
    "8.0.20",
    "8.0.21",
    "8.0.22",
    "8.0.23",
    "8.0.24",
    "8.0.25",
    "8.0.26",
    "8.0.27",
    "8.0.28",
    "8.0.29",
    "8.0.3",
    "8.0.30",
    "8.0.31",
    "8.0.32",
    "8.0.33",
    "8.0.4",
    "8.0.5",
    "8.0.6",
    "8.0.7",
    "8.0.8"
  ]
}
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet
Affected range Recorded fix
From 9.0.0-0 before 9.0.23Ecosystem versions9.0.23

Version evidence: OSV · GHSA-3g4v-f5gv-c7xf

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "9.0.0-0"
        },
        {
          "fixed": "9.0.23"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "9.0.0",
    "9.0.1",
    "9.0.10",
    "9.0.11",
    "9.0.12",
    "9.0.13",
    "9.0.14",
    "9.0.15",
    "9.0.16",
    "9.0.17",
    "9.0.18",
    "9.0.19",
    "9.0.2",
    "9.0.20",
    "9.0.21",
    "9.0.22",
    "9.0.3",
    "9.0.4",
    "9.0.5",
    "9.0.6",
    "9.0.7",
    "9.0.8",
    "9.0.9"
  ]
}
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet
Affected range Recorded fix
From 10.0.0-0 before 10.0.15Ecosystem versions10.0.15

Version evidence: OSV · GHSA-3g4v-f5gv-c7xf

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "10.0.0-0"
        },
        {
          "fixed": "10.0.15"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.0.0",
    "10.0.1",
    "10.0.10",
    "10.0.11",
    "10.0.12",
    "10.0.13",
    "10.0.14",
    "10.0.2",
    "10.0.3",
    "10.0.4",
    "10.0.5",
    "10.0.6",
    "10.0.7",
    "10.0.8",
    "10.0.9"
  ]
}
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet
Affected range Recorded fix
From 11.0.0-preview.1.26104.118 before 11.0.0Ecosystem versions11.0.0

Version evidence: OSV · GHSA-3g4v-f5gv-c7xf

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "11.0.0-preview.1.26104.118"
        },
        {
          "fixed": "11.0.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": []
}
high8.1
GHSA-p3jp-9v83-76w9No CVE assignedPackage fixes recorded

Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability

A buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege.

Recorded fixes — Microsoft.DotNet.ILCompiler: 8.0.33 or 9.0.22 or 10.0.14 or 11.0.0-rc.3.26522.148; Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64: 8.0.33 or 9.0.22 or 10.0.14 or 11.0.0-rc.3.26522.148; 75 more packages. Check your release branch.

Exploitation not established

NuGet / Microsoft.DotNet.ILCompilerNuGet / Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64NuGet / Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet
Affected range Recorded fix
From 8.0.0 before 8.0.33Ecosystem versions8.0.33

Version evidence: OSV · GHSA-p3jp-9v83-76w9

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "8.0.0"
        },
        {
          "fixed": "8.0.33"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "8.0.0",
    "8.0.1",
    "8.0.10",
    "8.0.11",
    "8.0.12",
    "8.0.13",
    "8.0.14",
    "8.0.15",
    "8.0.16",
    "8.0.17",
    "8.0.18",
    "8.0.19",
    "8.0.2",
    "8.0.20",
    "8.0.21",
    "8.0.22",
    "8.0.23",
    "8.0.24",
    "8.0.25",
    "8.0.26",
    "8.0.27",
    "8.0.28",
    "8.0.29",
    "8.0.3",
    "8.0.30",
    "8.0.31",
    "8.0.32",
    "8.0.4",
    "8.0.5",
    "8.0.6",
    "8.0.7",
    "8.0.8"
  ]
}
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet
Affected range Recorded fix
From 9.0.0 before 9.0.22Ecosystem versions9.0.22

Version evidence: OSV · GHSA-p3jp-9v83-76w9

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "9.0.0"
        },
        {
          "fixed": "9.0.22"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "9.0.0",
    "9.0.1",
    "9.0.10",
    "9.0.11",
    "9.0.12",
    "9.0.13",
    "9.0.14",
    "9.0.15",
    "9.0.16",
    "9.0.17",
    "9.0.18",
    "9.0.19",
    "9.0.2",
    "9.0.20",
    "9.0.21",
    "9.0.3",
    "9.0.4",
    "9.0.5",
    "9.0.6",
    "9.0.7",
    "9.0.8",
    "9.0.9"
  ]
}
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet
Affected range Recorded fix
From 10.0.0 before 10.0.14Ecosystem versions10.0.14

Version evidence: OSV · GHSA-p3jp-9v83-76w9

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "10.0.0"
        },
        {
          "fixed": "10.0.14"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.0.0",
    "10.0.1",
    "10.0.10",
    "10.0.11",
    "10.0.12",
    "10.0.13",
    "10.0.2",
    "10.0.3",
    "10.0.4",
    "10.0.5",
    "10.0.6",
    "10.0.7",
    "10.0.8",
    "10.0.9"
  ]
}
Microsoft.NETCore.App.Runtime.osx-arm64 NuGet
Affected range Recorded fix
From 11.0.0-preview.1 before 11.0.0-rc.3.26522.148Ecosystem versions11.0.0-rc.3.26522.148

Version evidence: OSV · GHSA-p3jp-9v83-76w9

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "11.0.0-preview.1"
        },
        {
          "fixed": "11.0.0-rc.3.26522.148"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": []
}