Improper link resolution before file access in the .NET framework allows an attacker who already has local authorization to bump their privileges. The flaw occurs when the runtime does not properly validate file paths or symbolic links before performing file operations, leading to a CWE‑59 condition. An attacker can use this to read or write files that should be protected, thereby escaping the intended access boundaries.

Microsoft .NET 9.0, .NET 10.0, and .NET 11.0 are vulnerable. The issue also affects Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.10, which rely on the underlying .NET runtimes for file handling.

The CVSS score of 6.7 indicates moderate severity, and with no EPSS data the exploitation likelihood is unknown but could be high for a local attacker. Because the vulnerability requires the attacker to be already authorized on the target machine, the threat vector is local. The vulnerability is not listed in the CISA KEV catalog, which does not diminish the need to patch, but it means no known widespread exploitation has been observed yet.