An out‑of‑bounds write flaw in Microsoft .NET enables an unauthorized attacker to cause arbitrary code execution over a network. This weakness can compromise confidentiality, integrity, and availability by allowing malicious code to run with the privileges of the affected process, potentially leading to full system takeover if the environment is not isolated.

Microsoft .NET versions 10.0, 11.0, 8.0, and 9.0 as well as Microsoft Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.10 are affected. These products correspond to the listed CPE identifiers.

The vulnerability has a CVSS score of 8.8, indicating a high severity and a likely potential for exploitation in network‑accessible contexts. Based on the description, it is inferred that the attack vector is a remote attacker delivering crafted input over a network to the vulnerable .NET component. The EPSS score is not available, so the exact likelihood of exploitation remains uncertain, and it is not currently listed in the CISA KEV catalog. The lack of a publicly disclosed exploit does not reduce the risk, as the flaw permits remote code execution without any user interaction, making it vulnerable to automated attacks.