An out‑of‑bounds write flaw exists in .NET that allows an unauthorized attacker to trigger arbitrary code execution over a network. This weakness can be exploited by sending specially crafted input to a vulnerable .NET component, causing the runtime to write beyond the bounds of a buffer and overwrite adjacent memory with attacker controlled data. The impact is the ability to execute arbitrary code with the privileges of the running process, potentially compromising confidentiality, integrity, and availability of the affected system.

The vulnerability affects Microsoft .NET versions 8.0, 9.0, 10.0, and 11.0, as well as Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.10. These products are listed in the CVE data and are the primary targets of this remote code execution issue.

The CVSS base score of 8.1 indicates high severity. The EPSS score is not available, so the current exploitation probability cannot be quantified. This vulnerability is not listed in the CISA KEV catalog, suggesting that there are no widely known exploitation campaigns yet. Based on the description, the likely attack vector is a network‑based input that exploits the out‑of‑bounds write, allowing an attacker to run code remotely. No specific prerequisites are mentioned beyond the presence of an exposed .NET interface that can receive the malicious payload.