The vulnerability is an out‑of‑bounds write in the .NET runtime that permits an attacker with local access to overwrite memory and execute arbitrary code. This flaw effectively grants elevation of privilege, allowing the attacker to gain administrative rights or control over the affected machine. The weakness is a classic buffer overrun (CWE-122 and CWE-787), which compromises integrity and confidentiality of data stored in memory and can lead to denial of service if exploited to crash an application.

Microsoft releases that contain the vulnerability include the .NET 8.0, 9.0 and 10.0 runtimes, as well as Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.8. All instances of these products before the published security update are potentially affected. Users should check the specific build they are running against the advisory and verify whether it contains the fix.

The CVSS score of 7.8 classifies the issue as high severity, though the EPSS score is not available, so the current exploitation likelihood is unknown but could be realistic for local attackers. The flaw is not listed in CISA KEV, indicating no known widespread exploitation yet. An attacker must have local code execution capabilities, for example by running a malicious DLL or manipulating a data stream processed by an untrusted .NET application, to trigger the overrun and achieve privilege escalation.