The vulnerability stems from .NET including functionality from an untrusted control sphere, allowing an attacker with network access to execute arbitrary code. The type of weakness is categorized as CWE-829, which indicates the execution of code originating from an untrusted source. If exploited, the attacker could take full control of the affected system, deploy malware, and pivot to other network assets.

The affected products are Microsoft .NET in its 10.0, 9.0, and 8.0 releases, as well as Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.10. These specific releases contain the vulnerable code paths that allow untrusted control input to lead to code execution.

The CVSS score of 7.5 indicates a high severity risk. No EPSS score is currently available, so exploitation probability is unclear, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote over a network connection to the vulnerable application. Successful exploitation would give the attacker the same privileges as the process running the .NET or Visual Studio runtime, potentially leading to full system compromise.