CVE-2026-33116
Description
- CVE ID
- CVE-2026-33116
- Package
- System.Security.Cryptography.Xml
- Sévérité de l’ECV
- Low
- EPPlus impact
- Low
Versions EPPlus affectées
- 8.5.1
- 8.5.0
- 8.4.2
- 8.4.1
- 8.4.0
- 8.3.1
- 8.3.0
- 8.2.1
- 8.2.0
- 8.1.1
- 8.1.0
- 8.0.8
- 8.0.7
- 8.0.6
- 8.0.5
- 8.0.4
- 8.0.3
- 8.0.2
- 8.0.1
Statut
fix-available — Une solution est disponible. Consultez l’avis pour plus de détails.
Advisory
Microsoft has released a security fix for a vulnerability in System.Security.Cryptography.Xml addressed in versions 10.0.6 and 9.0.15. EPPlus uses this package to create and validate digital signatures for workbooks. The risk for EPPlus users is considered very low, as EPPlus only passes known and validated XML to the affected library, which limits the ability for an attacker to exploit the vulnerability through EPPlus.
Update to EPPlus 8.5.3 to resolve this issue.
Informations sur la correction du paquet
Ces informations concernent le package en amont (System.Security.Cryptography.Xml), et non EPPlus. Consultez l’avis ci-dessus pour des conseils spécifiques à EPPlus.
| Target framework | Version du package | État fixe | Corrigé dans la version |
|---|---|---|---|
| net8.0 | 8.0.2 | fixed | 8.0.3 |
| net9.0 | 9.0.3 | fixed | 9.0.15 |
| net10.0 | 10.0.0 | fixed | 10.0.6 |
| net462 | 8.0.2 | fixed | 8.0.3 |
| netstandard2.0 | 8.0.2 | fixed | 8.0.3 |
| netstandard2.1 | 8.0.2 | fixed | 8.0.3 |
Chronologie
- Première détection
- 2026-04-16
- Dernière mise à jour
- 2026-04-16