Improper control of code generation, also known as code injection, allows a local attacker who can supply a crafted assembly or script to the .NET runtime to execute arbitrary code under the privileges of the host process. This vulnerability is represented by CWE‑94. If exploited, the attacker can gain administrative rights or other elevated privileges, potentially compromising confidentiality, integrity, or availability on the compromised host.

Microsoft .NET Framework versions 3.5 through 4.8.1, Microsoft .NET 8.0 and 9.0, and Microsoft Visual Studio 2022 versions 17.12, 17.14, and 18.7 (Visual Studio 2026).

The CVSS score of 7.8 indicates a high severity flaw that can be leveraged locally. With an EPSS score of less than 1%, the likelihood of widespread exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. An attacker must have local or process‑level access to supply the malicious assembly or invoke dynamic code generation. Upon success, injected code runs with the same privileges as the affected process, enabling the attacker to elevate privileges to system level without additional network or remote conditions.