A heap‑based buffer overflow occurs within the .NET runtime and associated Visual Studio components, permitting an attacker who can run code locally to gain elevated privileges on the machine. The flaw allows arbitrary memory writes that can alter execution flow, thus enabling the attacker to execute actions with higher privilege levels, which is classified as a local privilege escalation vulnerability. The weakness is identified by CWE‑122 and CWE‑20.

Microsoft .NET Framework versions 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 and 4.8.1, .NET 8.0, 9.0 and 10.0, as well as Microsoft Visual Studio 2017 (15.0‑15.9), Visual Studio 2019 (16.0‑16.10), Visual Studio 2022 (17.12‑17.14) and Visual Studio 2026 (18.5).

The CVSS score of 7.3 places this issue in the high severity range, and while an EPSS score is currently unavailable, the vulnerability is not listed in the CISA KEV catalog. The description explicitly states that the escalation is local, meaning an attacker must have the ability to execute code on the target system to leverage the flaw. Consequently, systems that allow local code execution on affected .NET or Visual Studio installations face a significant risk of privilege escalation.