The vulnerability arises from a permissive list of allowed inputs in the .NET runtime, which permits an unauthorized attacker to read sensitive information transmitted over the network. This flaw directly undermines confidentiality, exposing data that should remain private and aligns with the weakness identified as CWE-183. The impact is restricted to information disclosure rather than code execution or denial of service.

Affected products are Microsoft .NET releases 8.0, 9.0, 10.0, and 11.0, along with Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.10, all of which contain the permissive input validation flaw.

The CVSS score of 6.5 indicates a moderate severity risk. Microsoft does not currently list this vulnerability in the CISA KEV catalog, and the EPSS score is unavailable, which limits assessment of exploitation probability. The attack vector is inferred to be network-based, involving crafted inputs that bypass the whitelist and leak confidential data. No additional prerequisite has been documented, so the flaw can potentially be leveraged by any entity capable of sending appropriate network traffic to the affected application.