The vulnerability is an out-of-bounds write in the .NET Framework that allows an unauthorized attacker to execute arbitrary code remotely. This memory corruption flaw can be leveraged to gain code execution privileges on systems running the affected .NET components, potentially compromising confidentiality, integrity, and availability of the affected applications.

Affected systems include Microsoft .NET 10.0, .NET 11.0, .NET 8.0, .NET 9.0, and a broad range of .NET Framework releases from 3.5 through 4.8.1. The vulnerability also impacts Microsoft Visual Studio 2022 version 17.14 and the forthcoming Visual Studio 2026 version 18.10. All these products contain the affected code paths that can be triggered by a networked protocol or interop interface.

The CVSS score of 8.8 indicates high severity, and the lack of a published EPSS score coupled with the vulnerability’s nature suggests that exploitation could be attempted from remote, unauthenticated contexts. This is further supported by the description stating that an attacker can exploit the flaw over a network. While the vulnerability is not currently listed in CISA’s Known Exploited Vulnerabilities catalog, its remote code execution potential warrants close monitoring for possible active attacks.