2.7.11: Backport security fixes to release/2.7 (#41155)

• Bump Microsoft.NETCore.App.Runtime to 10.0.8 (CVE-2026-32175) (#40581)

Fixes Dependabot alerts #24 and #25.

Co-authored-by: Ben Hillis [email protected]
Co-authored-by: Copilot [email protected]
(cherry picked from commit 09a8afe)

• Update MSRDC to 1.2.7214 to fix CVE-2026-32157 (#40882)

Bumps Microsoft.RemoteDesktop.Client.MSRDC.SessionHost from 1.2.6676 to
1.2.7214. This closes CVE-2026-32157 (a use-after-free RCE in the Remote
Desktop client, first fixed in 1.2.7099) along with several additional
CVEs shipped in 1.2.7214.

Fixes #40868

Co-authored-by: Ben Hillis [email protected]
Co-authored-by: Copilot [email protected]
(cherry picked from commit 2a7269e)

• Update .NET runtime to 10.0.9 to fix CVE-2026-45491 (#40883)

Bumps Microsoft.NETCore.App.Runtime.win-x64 and win-arm64 from 10.0.8 to
10.0.9 to address CVE-2026-45491 (.NET tampering vulnerability), reported
by Dependabot. Both runtime packages are bumped together to keep the
.NET runtime version in sync across architectures.

Co-authored-by: Ben Hillis [email protected]
Co-authored-by: Copilot [email protected]
(cherry picked from commit 73a6afb)

Co-authored-by: Ben Hillis [email protected]
Co-authored-by: Copilot [email protected]
Co-authored-by: Ben Hillis [email protected]