The flaw is an integer overflow or wraparound that occurs in the .NET Framework, identified as CWE‑190. An attacker who can influence code execution on a target machine can overwrite values in memory and trigger the framework to execute arbitrary instructions, effectively compromising confidentiality, integrity, and availability of the system. The vulnerability requires the attacker to run or influence code locally; it does not rely on a network‑based trigger.

Microsoft .NET 10.0, .NET 8.0, and .NET 9.0; Microsoft .NET Framework 3.5 through 4.8.1, including the combined builds that include 3.5, 4.7.2, and 4.8; Microsoft Visual Studio 2022 version 17.14; and Visual Studio 2026 version 18.8.

The CVSS score of 7.0 indicates high severity, and the EPSS score, while less than 1 %, confirms that the exploit is unlikely to be widely used at present. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be local: an adversary must have a foothold that allows them to run or influence program behavior on the target machine. The high severity combined with this local requirement means systems that expose .NET components to untrusted input or run untrusted code warrant immediate attention.