Insertion of sensitive information into data that is sent over a network allows an unauthorized attacker to learn confidential data. This issue is a classic information exposure flaw, and it could enable attackers to gain a view of data that was intended to remain private. The vulnerability resides in the .NET runtime and could expose any application that relies on it to send sensitive data.

The flaw affects Microsoft .NET 8.0, 9.0, 10.0, and 11.0, as well as Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.10.

The CVSS score of 5.9 indicates a moderate severity, but the lack of an EPSS score makes it unclear how frequently this bug is currently exploited. Microsoft has not listed the vulnerability in its KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is network‑based: an attacker who can observe or intercept traffic from an affected application may capture the injected sensitive data. No elevation of privilege or remote code execution is involved, so the impact is limited to confidentiality. However, any disclosure of sensitive data can have significant consequences for compliance, privacy, and business continuity.