Cyber ·
USN-8958-1: three .NET vulnerabilities in the Ubuntu Security notice
Ubuntu Security notice describes three .NET flaws that may allow code execution, denial of service or local privilege escalation, identified as CVE-2026-102870, CVE-2026-111497 and CVE-2026-114148.
Notice USN-8958-1, dated 29 October 2026 in the Ubuntu Security feed and provided as a machine translation, covers three .NET vulnerabilities. The first is in the .NET Blazor WebAssembly debugging proxy, which did not escape certain values correctly; an attacker could possibly use it to execute arbitrary code. An earlier fix published in USN-8942-1 was found to be incomplete, and this issue affected only dotnet10 and dotnet11 (CVE-2026-102870). The second is in the Brotli decompression library used by .NET, which mishandled certain compressed streams; a remote attacker could possibly cause denial of service or execute arbitrary code (CVE-2026-111497). The third is a failure to handle file ownership correctly in certain circumstances, which could possibly allow local privilege escalation (CVE-2026-114148). The notice does not detail affected versions beyond those stated, nor give a fix date beyond the feed timestamp. To consult and verify, open the original Ubuntu notice through the feed link, compare installed package versions on your servers, and apply the update indicated by the vendor.