Microsoft .NET SDK: Local privilege escalation through TOCTOU race condition

Summary

A time-of-check time-of-use race condition in the .NET SDK's dotnet-watch tooling, including the Microsoft.DotNet.HotReload.Watch.Aspire package, allows a local attacker to elevate privileges on Linux and macOS. The attacker must be able to replace or modify a temporary solution file used by dotnet-watch during a later build, and the attack has high complexity and requires user interaction. Exploitation requires an authenticated local account; no remote vector is known. No exploitation or public proof-of-concept has been reported.

Affected

• Microsoft .NET 10.0 SDK on Linux and macOS: 10.0.0 to before 10.0.404 (CNA record)
• Microsoft .NET 11.0 SDK on Linux and macOS: 11.0.0-preview.1 to before 11.0.100 (CNA record)
• Microsoft.DotNet.HotReload.Watch.Aspire: 10.0.300 to before 11.0.100 (CNA record)
• Note: The GitLab advisory lists different start versions for the Aspire package and .NET 11 preview builds. Confirm the exact ranges on the MSRC page.

Fixed in

• .NET SDK 10.0.404
• .NET SDK 11.0.100
• Upgrade to these versions or later.

Workaround

• Unknown. Microsoft provides a patch and no vendor-documented interim workaround was found.
• Analyst suggestion, not vendor guidance: until patching, avoid running dotnet watch or Aspire hot reload on shared Linux or macOS hosts where untrusted local users can write to temporary directories.

Exploitation

• SSVC assessment: exploitation none, not automatable.
• Rapid7 lists exploitation status as N/A and public disclosure as No.
• No public proof-of-concept or exploitation reports were found at the time of research.

Our recommendation

• Inventory .NET SDKs on Linux and macOS hosts (dotnet --list-sdks) and any Aspire projects.
• Upgrade SDKs to 10.0.404, 11.0.100 or later with the normal November servicing cycle.
• Restrict local accounts and shared temporary directories on build hosts and CI runners.
• Check the MSRC page for the exact affected ranges before closing the ticket.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-114155 msrc.microsoft.com
• CVE Record CVE-2026-114155 www.cve.org
• GitHub issue dotnet/sdk #57040 github.com
• GitLab advisory: Microsoft.DotNet.HotReload.Watch.Aspire advisories.gitlab.com
• .NET November 2026 servicing updates (.NET blog) devblogs.microsoft.com
• Rapid7 Patch Tuesday November 2026 www.rapid7.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:51.