Improper neutralization of special elements within the .NET runtime creates a flaw that lets an attacker spoof network identities, enabling impersonation of legitimate services. This weakness, corresponding to the Common Weakness Enumeration 138, can compromise authentication mechanisms and lead to unauthorized access or data manipulation. The primary impact is that a malicious actor may appear as a trusted source over the network, potentially deceiving connected systems into accepting harmful input.

Microsoft .NET 10.0, .NET 9.0, .NET 8.0, and Microsoft Visual Studio 2022 versions 17.12 and 17.14 are affected. These versions may still be deployed in environments that rely on .NET for web or application services.

The vulnerability carries a CVSS score of 7.5, indicating a high severity assessment. While an EPSS score is not available and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, the description implies a network-based attack vector. Potential exploit paths would involve the delivery of crafted data containing special elements to a vulnerable .NET component, allowing an attacker to forge identities and bypass security controls. The lack of public exploit availability or known active exploitation reduces immediate risk, but the high score warrants prompt attention.