CVE-2026-47304
Descripción
- CVE ID
- CVE-2026-47304
- Paquete
- System.Security.Cryptography.Xml
- Severidad de la ECV
- High
- EPPlus impacto
- Medium
Versiones EPPlus afectadas
8.0.1 – 8.6.2
Estado
fix-available — Hay una solución disponible. Consulte el aviso para más detalles.
Asesoramiento
Microsoft has released a security fix for a security feature bypass vulnerability (CVE-2026-47304) in System.Security.Cryptography.Xml, addressed in versions 8.0.4, 9.0.18 and 10.0.10. The vulnerability concerns improper verification of cryptographic signatures, which may allow an invalid signature to be accepted as valid. EPPlus uses this package to create and validate digital signatures for workbooks, including validating the signature of a workbook when it is read. Applications that rely on EPPlus to validate workbook signatures — for example, to determine the authenticity of a workbook of unknown or untrusted origin — should update promptly. As stated in our security profile, the host application remains responsible for deciding whether a file is trusted before passing it to EPPlus.
Update to EPPlus 8.6.3 to resolve this issue.
Información sobre la corrección del paquete
Esta información se refiere al paquete upstream (System.Security.Cryptography.Xml), no a EPPlus. Consulta el aviso anterior para orientaciones específicas EPPlus.
| Target framework | Versión del paquete | Estado fijo | Corregido en la versión |
|---|---|---|---|
| net8.0 | 9.0.15 | fixed | 9.0.18 |
| net8.0 | 8.0.3 | fixed | 8.0.4 |
| net8.0 | 8.0.2 | fixed | 8.0.4 |
| net9.0 | 9.0.3 | fixed | 9.0.18 |
| net9.0 | 9.0.15 | fixed | 9.0.18 |
| net10.0 | 10.0.0 | fixed | 10.0.10 |
| net10.0 | 10.0.7 | fixed | 10.0.10 |
| net10.0 | 10.0.6 | fixed | 10.0.10 |
| net462 | 9.0.15 | fixed | 9.0.18 |
| net462 | 8.0.2 | fixed | 8.0.4 |
| net462 | 8.0.3 | fixed | 8.0.4 |
| netstandard2.0 | 8.0.2 | fixed | 8.0.4 |
| netstandard2.0 | 9.0.15 | fixed | 9.0.18 |
| netstandard2.0 | 8.0.3 | fixed | 8.0.4 |
| netstandard2.1 | 9.0.15 | fixed | 9.0.18 |
| netstandard2.1 | 8.0.3 | fixed | 8.0.4 |
| netstandard2.1 | 8.0.2 | fixed | 8.0.4 |
Cronología
- Detectado por primera vez
- 2026-07-22
- Última actualización
- 2026-07-24