An integer overflow or wraparound flaw in the .NET framework enables a local, unauthorized attacker to elevate privileges on the affected system. Because the vulnerability involves arithmetic processing that can be manipulated without proper bounds checking, an attacker can craft data that causes the runtime to grant higher privileges than the original user context. The flaw is classified as CWE-122 and CWE-190, indicating that unchecked memory or arithmetic operations can lead to privilege escalation rather than direct denial-of-service.

Microsoft’s .NET 10.0, .NET 8.0, and .NET 9.0 are affected, as well as Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.8. The vulnerability is present in the core runtime components used by applications compiled against these versions.

The CVSS score of 7.8 places the vulnerability in the high‑severity range, while the EPSS score is not available, meaning there is no current evidence of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is clearly local; an attacker with access to the host system can trigger the overflow by supplying crafted input to the .NET runtime or applications built on it. Given the high severity and local nature, administrators should assume that an elevated user could compromise the entire system if the flaw is exploited.