Update .NET runtime to 10.0.9 to fix CVE-2026-45491 (#40883)
Bumps Microsoft.NETCore.App.Runtime.win-x64 and win-arm64 from 10.0.8 to 10.0.9 to address CVE-2026-45491 (.NET tampering vulnerability), reported by Dependabot. Both runtime packages are bumped together to keep the .NET runtime version in sync across architectures. Co-authored-by: Ben Hillis <benhill@ntdev.microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ben Hillis committed
Jun 23, 2026 at 16:55 UTC
73a6afb011ef36731ea1f038d74e985f41a2a937
1 file changed
+2
-2
packages.config
+2
-2
@@ -8,8 +8,8 @@
8
<package id="Microsoft.DXCore.Linux.arm64fre" version="10.0.26100.1-240331-1435.ge-release" targetFramework="native" />
9
<package id="Microsoft.Extensions.Hosting" version="10.0.0" />
10
<package id="Microsoft.Identity.MSAL.WSL.Proxy" version="0.1.1" />
11
- <package id="Microsoft.NETCore.App.Runtime.win-arm64" version="10.0.8" />
12
- <package id="Microsoft.NETCore.App.Runtime.win-x64" version="10.0.8" />
11
+ <package id="Microsoft.NETCore.App.Runtime.win-arm64" version="10.0.9" />
12
+ <package id="Microsoft.NETCore.App.Runtime.win-x64" version="10.0.9" />
13
<package id="Microsoft.RemoteDesktop.Client.MSRDC.SessionHost" version="1.2.7214" />
14
<package id="Microsoft.Taef" version="10.100.251104001" targetFramework="native" />
15
<package id="Microsoft.Windows.CsWinRT" version="2.2.0" />