{
  "threat_severity" : "Important",
  "public_date" : "2026-07-14T19:29:57Z",
  "bugzilla" : {
    "description" : "dotnet: .NET: Local code execution via deserialization of untrusted data",
    "id" : "2500563",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2500563"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-502",
  "details" : [ "Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.", "A flaw was found in .NET. This vulnerability allows an unauthorized attacker to execute code locally by exploiting a deserialization of untrusted data. This means that if an attacker can provide specially crafted data, the .NET application may process it in a way that leads to the execution of malicious code on the system where the application is running." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-19T00:00:00Z",
    "advisory" : "RHSA-2026:27171",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "dotnet9-0-main-9.0.118-1.hum1",
    "impact" : "important"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-20T00:00:00Z",
    "advisory" : "RHSA-2026:42145",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "dotnet8-0-main-8.0.129-2.1.hum1",
    "impact" : "important"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "dotnet10.0",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "dotnet8.0",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "dotnet9.0",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "dotnet10.0",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "dotnet8.0",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "dotnet9.0",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "dotnet10.0",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "dotnet8.0",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "dotnet9.0",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "dotnet10.0",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "impact" : "important"
  }, {
    "product_name" : "Red Hat OpenShift Dev Spaces",
    "fix_state" : "Not affected",
    "package_name" : "devspaces/udi-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_devspaces:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-50649\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50649\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50649" ],
  "name" : "CVE-2026-50649",
  "csaw" : false
}