What is the CVSS score of CVE-2026-32177?

CVE-2026-32177 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of .NET Framework are affected by CVE-2026-32177?

CVE-2026-32177 is a local privilege escalation vulnerability in Microsoft .NET Framework (versions 3.5-10.0) and Visual Studio 2017 that allows unprivileged users to achieve code execution through…. A patch is available.

Is there a public PoC exploit available for CVE-2026-32177?

Yes, a public proof-of-concept exploit is available for CVE-2026-32177. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-32177?

Within 24 hours: Identify all systems running .NET Framework versions 3.5-10.0 and Visual Studio 2017 using asset inventory or SCCM. Within 7 days: Apply Microsoft-released patches across all affected .NET Framework versions and Visual Studio 2017 per MSRC advisory; prioritize developer workstations and servers processing untrusted .NET content. Within 30 days: Verify patch deployment via vulnerability scanning; document exceptions for systems requiring extended timelines.

.NET Framework CVE-2026-32177

EUVD-2026-29572 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-12 microsoft

Buffer Overflow Heap Overflow Microsoft Microsoft Net Framework 3 5 Microsoft Net Framework 3 5 And 4 7 2 Microsoft Net Framework 3 5 And 4 8 Microsoft Net Framework 3 5 And 4 8 1 Microsoft Net Framework 4 6 2 4 7 4 7 1 4 7 2 Microsoft Net Framework 4 8 Net 10 0 Net 8 0 Net 9 0 Microsoft Visual Studio 2022 Version 17 12 Microsoft Visual Studio 2022 Version 17 14 Microsoft Visual Studio 2017 Version 15 9 Includes 15 0 15 8 Microsoft Visual Studio 2019 Version 16 11 Includes 16 0 16 10 Microsoft Visual Studio 2026 Version 18 5

7.3

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.3 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

ENISA EUVD

HIGH

qualitative

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 18:31 vuln.today

CVE Published

May 12, 2026 - 16:58 nvd

HIGH 7.3

DescriptionCVE.org

Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through heap-based buffer overflow exploitation requiring user interaction with a malicious file. Attackers without initial privileges can achieve high-level code execution and data access by convincing a user to open a specially crafted document or application. Microsoft has released patches across all affected .NET versions per MSRC advisory, indicating this is a vendor-confirmed issue requiring immediate remediation for systems where users process untrusted .NET content.

Technical ContextAI

This vulnerability affects the core .NET runtime across multiple framework versions including legacy .NET Framework 3.5-4.8.1, modern .NET 8.0-10.0, and Visual Studio 2017 development environments. The root cause is CWE-122 (heap-based buffer overflow), a memory corruption flaw where untrusted input causes the runtime to write beyond allocated heap boundaries during processing. Unlike stack overflows, heap corruption can be more complex to exploit but enables precise memory manipulation for privilege escalation. The widespread CPE coverage indicates the flaw resides in shared .NET runtime components used across framework versions, affecting both application execution and development tool environments where .NET assemblies are processed.

RemediationAI

Apply security updates from Microsoft Security Response Center immediately via Windows Update or manual download from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32177, ensuring patches match specific .NET Framework and runtime versions installed. For Visual Studio 2017 environments, update to the latest servicing release through Visual Studio Installer. Until patching is complete, implement application whitelisting (AppLocker/Windows Defender Application Control) to restrict .NET assembly execution to trusted publishers only, though this may impact developer workflows and legitimate business applications requiring policy exceptions. Educate users to avoid opening .NET executables, DLLs, or Visual Studio project files from untrusted sources including email attachments and unverified downloads. On high-risk systems, consider temporarily disabling .NET Framework versions not actively required by business applications, noting that many Windows components and third-party software have .NET dependencies that may break if disabled.