Untrusted data supplied to a .NET application can be deserialized in a way that allows an attacker to send a crafted payload over a network and execute arbitrary code. The vulnerability, identified as a data serialization flaw, gives the attacker the potential to run code with the permissions of the application, which can compromise confidentiality, integrity, and availability of the affected system.

Microsoft .NET 10.0, 11.0, 8.0, 9.0 and Microsoft .NET Framework 3.5 through 4.8.1, including the .NET Framework 4.8.1 and earlier milestones listed. Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.10 are also susceptible.

The CVSS score of 8.8 classifies this as a high severity flaw. The EPSS score of 0.01266 indicates a very low likelihood of exploitation in the near future. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation yet. The likely attack vector is remote over a network, as the flaw is triggered by an attacker sending a crafted serialized payload.