Microsoft Fixes ASP.NET Core Information Disclosure Flaw CVE-2026-114150

Microsoft released a fix for CVE-2026-114150, an ASP.NET Core information disclosure vulnerability caused by use of an uninitialized resource. An unauthenticated attacker could exploit the flaw over a network without user interaction, although attack complexity is high. Microsoft rates the vulnerability Important, with a CVSS v3.1 base score of 5.9. At its November 10 disclosure, Microsoft reported no public disclosure or observed exploitation and assessed exploitation as less likely.

The underlying weakness, CWE-908, occurs when software accesses a resource before it has been properly initialized. MITRE notes that this weakness can expose information or cause other failures, depending on how the resource is used; those broader outcomes are not established impacts of this ASP.NET Core flaw. Organizations running ASP.NET Core should review Microsoft's advisory for affected versions and apply the official security update. Development teams can reduce similar risks through explicit resource initialization, checks of conditional and concurrent execution paths, and build warnings for uninitialized data.