An out‑of‑bounds read in Microsoft .NET allows an attacker who can send crafted requests to a .NET application to read memory beyond the intended buffer and disclose the content over the network. This can lead to leakage of sensitive data such as configuration details, authentication tokens, or other confidential information that resides in the application memory space. The weakness is classified as CWE‑125, an out‑of‑bounds read vulnerability that directly compromises confidentiality.

The vulnerability affects Microsoft .NET versions 8.0, 9.0, 10.0, and 11.0, as well as Microsoft Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.10. Users running any of these runtimes or development environments without the latest security update are potentially exposed.

The CVSS score of 7.5 indicates high severity and potential for serious data exposure. The EPSS score is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that an active exploit may not yet be widespread. The likely attack vector is a network‑based interaction with a vulnerable .NET application; an attacker does not require elevated local privileges. If the application is exposed to untrusted networks, the vulnerability can be leveraged to exfiltrate information, making it a significant risk to confidentiality for affected deployments.