This vulnerability is an out‑of‑bounds write in the .NET runtime that can be triggered through a network request. An attacker who can deliver a specially crafted packet to a service or application built on the affected runtime can cause the runtime to write beyond an array boundary, which can be leveraged to execute arbitrary code with the privileges of the running process. The consequence is full compromise of the targeted process and any resources it accesses, including confidential data, code signing keys, or the underlying operating system if the process runs with elevated rights.

Affected products include Microsoft .NET 10.0, .NET 11.0, .NET 8.0, .NET 9.0, Microsoft .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, 4.8.1, Microsoft Visual Studio 2022 version 17.14, and Microsoft Visual Studio 2026 version 18.10. Systems using any of these runtimes, libraries, or IDEs are potentially vulnerable.

The CVSS score of 8.8 indicates a high severity Remote Code Execution vulnerability with no restriction on network access as an attacker can send the exploit over the network. The EPSS score is not available, so the current probability of exploitation is unknown, but the lack of listing in CISA’s KEV catalog suggests that no widespread exploitation has been observed yet. The likely attack vector is a network‑based exploit where an unauthenticated attacker sends malicious data to a vulnerable application, causing an out‑of‑bounds write and ultimately arbitrary code execution. Successful exploitation would give an attacker full control of the impacted application or service.