This vulnerability allows an attacker to trigger an out‑of‑bounds read in the .NET runtime, resulting in a denial of service that can be exercised over a network. The weakness is classified as CWE‑125 and can cause the affected application to crash or become unresponsive, disrupting availability for legitimate users.

The flaw affects Microsoft .NET 9.0 and 10.0, as well as the Microsoft Bcl.Memory library. Systems running these components on Windows, Linux, macOS, or in cloud environments such as Red Hat Enterprise Linux 8/9/10.1 are potentially vulnerable. Any application that loads the affected .NET framework or library is at risk.

The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1% suggests a low probability of being actively exploited. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote network attacker sending a crafted exploit to the vulnerable .NET component; local privilege is not required.