For administrators, the key task is matching each affected installation or component to its fixed build—not treating this as a single, platform-wide update.
What the vulnerability allows
Microsoft describes the flaw as a “Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally.” It is classified as CWE-367.
In practical terms, a time-of-check/time-of-use weakness involves a gap between checking a condition and acting on it. If an attacker can change the relevant state during that gap, the operation may proceed under assumptions that no longer hold. This explains the vulnerability class; it does not establish the specific exploitation sequence for this flaw.
Microsoft’s advisory makes two important distinctions:
- Exploitation requires winning a race condition. This is why the CVSS attack-complexity metric is AC:H, or high.
- Successful exploitation could allow code execution with another user’s permissions. The attacker could consequently access data and resources available to that user.
That second point matters: the advisory describes gaining another user’s permissions, not an unconditional guarantee of the highest privileges on the system.
Severity, scores and reported status
Microsoft supplies the following assessment for CVE-2026-114155:
| Field | Value |
|---|---|
| Severity | Important |
| CVSS base score | 7.5 |
| CVSS temporal score | 6.5 |
| Weakness | CWE-367 |
| Exploitation assessment | N/A |
The complete supplied CVSS vector is:
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Its metrics describe a local attack requiring low privileges, high attack complexity and user interaction, with changed scope and high potential impacts to confidentiality, integrity and availability.
Microsoft’s reported status is:
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
These status fields reflect the advisory’s assessment, not a reason to postpone remediation. A difficult race condition remains a security boundary problem when successful exploitation can expose another user’s resources.
Affected products and fixed builds
Microsoft’s affected-product information identifies the following mappings:
| Affected product | Vendor fixed build |
|---|---|
| .NET 10.0 installed on Linux | 10.0.404 |
| .NET 10.0 installed on Mac OS | 10.0.404 |
| .NET 11.0 installed on Linux | 11.0.100 |
| .NET 11.0 installed on Mac OS | 11.0.100 |
| Microsoft.DotNet.HotReload.Watch.Aspire | 10.0.404; 11.0.100 |
KB5135241 maps to fixed build 10.0.404 for both listed .NET 10.0 operating-system entries.
The exact remediation instructions are:
- For .NET 10.0 installed on Linux, install KB5135241 to reach fixed build 10.0.404.
- For .NET 10.0 installed on Mac OS, install KB5135241 to reach fixed build 10.0.404.
- For .NET 11.0 installed on Linux, update to fixed build 11.0.100 or later.
- For .NET 11.0 installed on Mac OS, update to fixed build 11.0.100 or later.
- For Microsoft.DotNet.HotReload.Watch.Aspire, update to fixed build 10.0.404 or later; update to fixed build 11.0.100 or later.
Turn the advisory into a deployment check
The useful operational distinction is that Microsoft lists both operating-system-specific .NET installations and a named component. A remediation checklist should therefore track those entries separately rather than assuming that updating one entry proves every affected component is fixed.
Using Microsoft’s mappings, administrators can structure their verification around three questions:
- Which listed product is present? Record the operating system, .NET release line and whether Microsoft.DotNet.HotReload.Watch.Aspire is deployed.
- Which remediation applies? Match each entry to its corresponding fixed build instead of treating 10.0.404 and 11.0.100 as interchangeable targets.
- What build remains deployed after maintenance? Confirm the resulting component version against the applicable remediation instruction before closing the security task.
This is a deployment-planning recommendation derived from the supplied product mappings, rather than an additional vendor installation procedure.
The bottom line: CVE-2026-114155 requires customer action, even with high attack complexity and no exploitation reported in Microsoft’s status. Apply the appropriate fix, verify each affected component, and keep the distinction between another user’s permissions and unrestricted system control clear when assessing the risk.