Technical impact
A heap‑based buffer overflow occurs within the .NET runtime and associated Visual Studio components, permitting an attacker who can run code locally to gain elevated privileges on the machine. The flaw allows arbitrary memory writes that can alter execution flow, thus enabling the attacker to execute actions with higher privilege levels, which is classified as a local privilege escalation vulnerability. The weakness is identified by CWE‑122, CWE‑20, and CWE‑787.
Affected Systems
Microsoft .NET Framework versions 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 and 4.8.1, .NET 8.0, 9.0 and 10.0, as well as Microsoft Visual Studio 2022 version 17.12, 17.14 and Microsoft Visual Studio 2026 version 18.5.
Risk and Exploitability
The CVSS score of 7.3 places this issue in the high severity range. The EPSS score of 0.00551 indicates a very low probability of exploitation, although the flaw remains a high‑severity vulnerability and is not listed in the CISA KEV catalog. The description explicitly states that the escalation is local, meaning an attacker must have the ability to execute code on the target system to leverage the flaw. Consequently, systems that allow local code execution on affected .NET or Visual Studio installations face a significant risk of privilege escalation.
