Untrusted data deserialization in Microsoft .NET 8.0 and 9.0, as well as in the .NET Framework versions 3.5 through 4.8.1, and in Microsoft Visual Studio 2026 18.7 allows an attacker to execute arbitrary code within the context of a vulnerable application. The flaw is a classic serialization weakness (CWE‑502) where insufficient validation of serialized payloads enables local code execution, potentially leading to privilege escalation or full host compromise.

Affected products include Microsoft .NET runtimes 8.0 and 9.0, Microsoft .NET Framework versions 3.5, 4.6.2 to 4.8.1, and Microsoft Visual Studio 2026 version 18.7.

The CVSS score of 7.8 highlights a high impact vulnerability, while the EPSS score of < 1% indicates a very low probability of exploitation at present and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector involves supplying crafted serialized data to a deserializing process, which could come from local files, network connections, or interprocess communication. Successful exploitation requires an attacker to supply the malicious payload to a vulnerable application, which then deserializes it and executes embedded code.