The flaw arises from improper link resolution before file access, or 'link following', inside Microsoft .NET. A local user with legitimate authorization can influence the path that the framework resolves. Because the resolution does not enforce secure access checks, the user can cause the runtime to open, read, modify, or delete files outside the intended directory. The weakness is tied to using untrusted relative paths (CWE‑59) and the failure to enforce read/write checks (CWE‑345). The result is a loss of data integrity and potential disclosure of sensitive information residing in arbitrary files on the system.

Microsoft .NET 8.0, 9.0 and 10.0 are affected. Additionally, Microsoft Visual Studio 2022 versions 17.12, 17.14, and the upcoming Visual Studio 2026 version 18.7 are impacted. Any installation that includes these products and has not been updated with the vendor’s fix is at risk.

The CVSS score of 7.0 indicates a moderate‑to‑high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not currently listed in CISA’s KEV catalog. Attackers must already have authorized system access to exploit the flaw, so the attack vector is local. Once the vulnerability is triggered, the attacker can tamper with files, potentially altering application behavior or compromising data integrity.