Deserialization of untrusted data in .NET enables an attacker to execute arbitrary code remotely. The flaw arises when the framework accepts serialized payloads without validating their integrity or origin, allowing malicious data to trigger code execution on the target system. An unauthorized adversary could therefore compromise the confidentiality, integrity, and availability of affected applications.

Microsoft .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11.0; Microsoft Visual Studio 2022 version 17.14; Microsoft Visual Studio 2026 version 18.10. These versions of the framework and IDE are impacted by the deserialization vulnerability.

The CVSS score of 8.8 indicates a high severity and the absence of an EPSS score suggests limited public exploitation data, though the vulnerability remains unlisted in the CISA KEV catalog. Based on the description, the likely attack vector is over a network, where an attacker can send a crafted serialized payload to a vulnerable application. Exploitation requires the target to deserialize data from an untrusted source and would grant the attacker full code execution privileges on the host machine.