Protection mechanism failure in the .NET Framework allows an unauthorized attacker to execute arbitrary code locally. The flaw arises from improper handling of serialized data (CWE‑502), a weakness in authentication or credential validation (CWE‑693), and an unauthorized exposure of trusted subject identifiers (CWE‑807). While the vulnerability does not explicitly mention privilege escalation, executing code on a host could enable an attacker to potentially acquire higher privileges if the process runs with elevated rights.

Microsoft .NET 8.0 and 9.0, all supported Microsoft .NET Framework versions from 3.5 through 4.8.1, Microsoft Visual Studio 2022 versions 17.12 and 17.14, Microsoft Visual Studio 2026 version 18.7, and RedHat Hummingbird 1 are all impacted.

The CVSS score of 7.8 classifies this issue as high severity. An EPSS score of < 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker must deliver a malicious serialized payload or otherwise trigger the vulnerable component on a compromised or otherwise reachable system. The potential for privilege escalation is inferred but not directly documented in the advisory. Given the high severity and the fact that local code execution can lead to significant security compromise, organizations should prioritize applying the relevant updates as soon as possible.