Improper link resolution before file access (link following) in .NET allows an unauthorized local attacker to tamper with system files. The flaw corresponds to CWE-59, enabling path traversal or link manipulation that can alter or replace files considered safe. This can degrade system integrity but does not provide remote execution or data exfiltration unless additional vulnerabilities are present.

The vulnerability affects Microsoft .NET 10.0, .NET 9.0, and .NET 8.0, as listed by the CNA. All affected installations of these versions are susceptible; no additional sub‑version filtering is provided.

The CVSS score of 6.2 indicates a medium severity for the ability to tamper locally. EPSS data is unavailable, so the exact exploitation probability cannot be quantified, but the lack of a KEV listing suggests no widespread exploitation currently. The likely attack vector requires local or Privileged access to trigger the vulnerable link resolution path. Therefore, the risk is moderate for environments where untrusted code might be executed or unchecked file permissions exist.