An attacker with authorized access can exploit an untrusted search path flaw in Microsoft .NET Framework to bypass a security feature locally. This flaw falls under CWE-426 and can undermine application integrity and potentially facilitate unauthorized actions. The vulnerability allows a local user to execute unintended binaries, thereby bypassing intended protection mechanisms within the framework.

Microsoft .NET Framework versions 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 and 4.8.1 are impacted according to the CNA vendor/product listing. Systems running any of these framework releases are susceptible to the flaw.

The CVSS score is 8.8, categorising the issue as high severity. EPSS data is not available, so the exploitation likelihood cannot be precisely quantified, but the lack of a KEV listing indicates no known widespread exploitation. The local attack nature implies that the threat is limited to authenticated users, yet it provides a means to compromise protected components inside the framework by leveraging the untrusted search path.