This vulnerability arises from improper control of code generation in ASP.NET Core, enabling an attacker to inject and execute arbitrary code over the network. The weakness is a classic code injection flaw (CWE‑94) that can compromise confidentiality, integrity, and availability of the affected application and potentially the underlying host.

The affected products include Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10, and the Microsoft ASP.NET Core Components WebAssembly Server (no specific client‑side version listed). Only the specified Visual Studio releases and the core server component are known to be vulnerable.

The CVSS score of 8.8 classifies this flaw as a high‑severity vulnerability. EPSS data is not available, but the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a remote network attacker sending malicious input that the application processes to generate code, allowing remote code execution. The high natural severity and lack of mitigation guidance suggest that the threat is significant and should be addressed promptly.