The flaw arises when .NET improperly handles a missing special element during communication. An attacker who can influence the network exchange may craft messages that appear to originate from a legitimate source, enabling spoofing. This compromises the integrity of authenticated interactions and can lead to further attacks such as phishing or unauthorized access. The weakness is identified as CWE‑166, which describes improper validation or implementation of data structures.

The vulnerability affects Microsoft’s .NET framework versions 10.0, 8.0, and 9.0. No additional product version details are supplied, and the attack is driven by missing data elements in network‑delivered streams rather than OS or hardware dependencies.

The CVSS score of 7.5 indicates a high severity of potential impact when the flaw is triggered. The EPSS score of less than 1 % suggests that exploitation attempts are currently rare, and the vulnerability is not yet catalogued by CISA’s KEV list. The likely attack vector is a network‑based transmission of crafted data to a .NET application that performs inadequate validation. Because the flaw requires injection of a missing special element, the conditions for exploitation are relatively specific, which limits its immediate threat but still warrants monitoring.