Improper link resolution before file access in the .NET framework allows a user with local access to manipulate symbolic links or shortcuts so that protected files are read or written with elevated privileges. The flaw can lead to unauthorized data disclosure, modification, or system takeover by an attacker who already has user‑level access. This type of privilege escalation is categorized under CWE‑59, indicating that the runtime does not properly validate or restrict the target of a link.

The vulnerability affects Microsoft .NET versions 9.0, 10.0, and 11.0, as well as Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.10. Systems running any of these runtimes or IDEs without the latest security updates are potentially exposed.

The CVSS score of 7.3 reflects a moderate to high severity, and the EPSS score is currently not available, but the lack of a KEV listing suggests that widespread exploits are not yet documented. The flaw is local and requires the attacker to have the ability to create or modify links on the affected machine; once the link is resolved, the program reads or writes a file as the operating system user, which can be leveraged to gain higher privileges or compromise the application. Because the attack is local and does not require network or administrative privileges to initiate, the risk is present on any machine where an authorized user can use the vulnerable .NET code.