This vulnerability arises from an origin validation error in the .NET runtime that permits an unauthorized attacker to read sensitive data. An attacker could construct network requests that bypass the reference origin check, causing the application to expose information. The weakness is categorized as CWE‑346, indicating externally controllable input leading to improper validation.

Affected systems include Microsoft .NET 8.0, .NET 9.0, .NET 10.0 and .NET 11.0, as well as Microsoft Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.9. The issue applies to the listed releases and their current configurations.

The CVSS score of 6.5 reflects moderate severity, and the EPSS score is not available, indicating no current data on exploit prevalence. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires an attacker to send crafted requests over a network that mistreat the origin header, enabling data disclosure. The risk is moderate, with potential for an attacker to gain access to confidential information if the affected software processes incoming network traffic without proper origin validation.