Ubuntu releases security updates for .NET to address RCE and privilege escalation

Ubuntu has issued security notice USN-8958-1 to address several critical vulnerabilities within the .NET ecosystem. The updates target the .NET CLI tools and runtime, specifically affecting versions 8, 10, and 11. These flaws range from improper value escaping in debug proxies to errors in decompression handling.

Users running Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 are affected depending on their installed .NET packages. The patches address risks of remote code execution (RCE), denial of service (DoS), and local privilege escalation, ensuring that the runtime and SDK components are secured against these specific attack vectors.

Vulnerability breakdown and affected components

• Blazor WebAssembly Debug Proxy: CVE-2026-102870 involves improper escaping of certain values, which could allow an attacker to execute arbitrary code; notably, a previous fix in USN-8942-1 was found to be incomplete for dotnet10 and dotnet11.
• Brotli Decompression: CVE-2026-111497 identifies an issue where the Brotli library used by .NET incorrectly processes specific compressed streams, potentially leading to remote code execution or denial of service.
• File Ownership Handling: CVE-2026-114148 addresses a flaw where .NET fails to properly manage file ownership under certain conditions, creating a path for local privilege escalation.
• Package Scope: The security updates cover a wide range of packages including aspnetcore-runtime, dotnet-host, dotnet-hostfxr, dotnet-runtime, dotnet-sdk, and dotnet-sdk-aot.

Why it matters

System administrators and developers using .NET on Ubuntu must apply these updates to prevent local users from gaining elevated permissions or remote attackers from compromising web applications. The incomplete fix for the Blazor debug proxy highlights the importance of verifying patch application in complex development environments.