Microsoft .NET and Visual Studio expose sensitive configuration information. An attacker with legitimate access can read this data, and because the flaw provides a way to misuse it as a low‑overhead local privilege escalation vector, the attacker can elevate their privilege level on the host system. The issue is categorized under CWE‑200 (Information Exposure) and CWE‑94 (Improper Control of Generation of Code via Untrusted Input), indicating that the information disclosure and potential misuse of code execution paths are the root causes. As a result, the attacker can potentially gain administrative rights on the system running the affected .NET runtime or Visual Studio.

Microsoft .NET 9.0, 10.0, and 11.0 as well as Microsoft Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.9 are impacted by this CVE. The affected versions are those explicitly listed in the vendor product references; no further narrowing of sub‑versions is provided.

The CVSS score of 7 indicates a medium‑to‑high severity, and the EPSS score is <1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local – it requires an authorized attacker with existing access to the affected environment to exploit the information disclosure. Once exploited, the attacker can gain significant administrative control over the affected system, posing a substantial risk to resources running the impacted .NET components.