Deserialization of untrusted data in multiple versions of the .NET Framework allows an attacker to run arbitrary code on the target system. This flaw is a classic example of serialization manipulation (CWE‑502) and can compromise confidentiality, integrity, and availability of the affected application and host. An attacker who succeeds can gain the same permissions as the application, potentially leading to full system compromise.

Microsoft .NET 10.0, .NET 11.0, .NET 8.0, .NET 9.0, .NET Framework 3.5, .NET Framework 4.6.2/4.7/4.7.1/4.7.2/4.8/4.8.1, Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10.

The CVSS score of 8.8 classifies this as a High severity vulnerability, meaning that an exploit could deliver excessive damage if successful. The EPSS score is 1%, indicating a low but nonzero likelihood of exploitation; however, the lack of a KEV listing does not diminish the potential impact. The likely attack vector is network‑based; an unauthenticated attacker would need to provide malicious serialized payloads to a service or application that deserializes data without proper validation. Once deserialization occurs, the attacker can execute arbitrary code with the permissions of the application process.