Technical impact
The CVE describes improper input validation in the .NET runtime that allows an unauthorized local attacker to elevate privileges. The vulnerability arises when crafted input bypasses input checks, leading to an escalation of privileges within the affected process. This flaw is classified as CWE-20 (Improper Input Validation) and CWE-190 (Integer Overflow). The CVE notes no arbitrary code execution or broader impacts beyond the privilege escalation.
Affected Systems
Microsoft .NET 10.0, Microsoft .NET 8.0, Microsoft .NET 9.0, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 4.8 are affected. Any application that links against these runtimes runs the vulnerable code and is susceptible to local privilege escalation when a local attacker can trigger the overflow.
Risk and Exploitability
The CVE description states that improper input validation in .NET allows an unauthorized attacker to elevate privileges locally, and does not mention arbitrary code execution or broader impacts beyond the elevation. The CVSS score of 7.3 indicates moderate-to-high severity. The EPSS score of less than 1 percent suggests a low but non-zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning there are no publicly known exploits. An attacker would need local access and the ability to supply crafted input to trigger the vulnerability, granting elevated privileges on the compromised host.
Github GHSA