The flaw is an improper limitation of a pathname to a restricted directory in Microsoft .NET. This path‑traversal defect allows an authorized local user to supply a crafted path that bypasses the intended directory boundaries, enabling the attacker to read, modify or delete files outside the sandbox and effectively elevate privileges or corrupt protected resources. The weakness is classified as CWE-22, a path‑traversal attack.

Affected products include Microsoft .NET 9.0, 10.0, and 11.0, as well as Microsoft Visual Studio 2022 (version 17.14) and Visual Studio 2026 (version 18.10). The flaw is present in the versions listed; newer releases beyond these have not been confirmed to contain the fix.

The CVSS score of 7.3 indicates high severity with local impact. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting limited publicly known exploitation. The attack requires local authorized access, so the risk is medium‑high for systems that allow users to submit paths to .NET APIs. An exploiter could gain elevated privileges and potentially compromise the system. Monitoring for anomalous path usage and applying the vendor patch are recommended.