What is the CVSS score of CVE-2026-35433?

CVE-2026-35433 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of .NET are affected by CVE-2026-35433?

Microsoft .NET Windows Desktop Runtime versions 8.0 through 10.0 contain a privilege escalation vulnerability that allows local attackers to achieve system-level access by delivering crafted input to…. A patch is available.

Is there a public PoC exploit available for CVE-2026-35433?

Yes, a public proof-of-concept exploit is available for CVE-2026-35433. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-35433?

Within 24 hours, scan infrastructure to identify all Windows systems running .NET Runtime versions 8.0, 9.0, or 10.0, prioritizing business-critical applications and high-value workstations. Within 7 days, obtain and deploy the patched versions of the affected .NET runtimes from the Microsoft security advisory, coordinating with application teams to confirm compatibility before production deployment. Within 30 days, complete patch validation across the environment, verify remediation status, and establish monitoring to confirm no remaining vulnerable instances remain.

.NET CVE-2026-35433

EUVD-2026-29634 HIGH

Improper Input Validation (CWE-20)

2026-05-12 microsoft

GHSA-8x9c-mqxv-q2pp

Authentication Bypass Microsoft Net 10 0 Net 8 0 Net 9 0

7.3

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.3 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.3 HIGH

Local vector and required user interaction to open crafted input (AV:L, UI:R); no attacker privileges needed (PR:N); memory corruption yields high C/I and partial availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 22:10 vuln.today

Analysis Generated

Jul 23, 2026 - 22:10 vuln.today

CVE Published

May 12, 2026 - 16:58 nvd

HIGH 7.3

DescriptionCVE.org

Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.

AnalysisAI

Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an attacker to run code at a higher privilege level after a targeted user opens crafted input. The root cause combines improper input validation (CWE-20) with a heap-based buffer overflow (CWE-122), yielding total technical impact per CISA SSVC. Publicly available exploit code exists, but the vulnerability is not in CISA KEV and EPSS is low (0.11%, 30th percentile), indicating no observed widespread exploitation to date.

Technical ContextAI

The affected component is the Windows Desktop runtime shipped with .NET (the Microsoft.WindowsDesktop.App.Runtime.win-arm64/x64/x86 packages), which underpins WPF desktop applications; the security advisory is published under the dotnet/wpf repository. CPE data confirms the affected products are Microsoft .NET 8.0, 9.0, and 10.0 on Windows across all architectures. The weakness is classified as CWE-20 (Improper Input Validation) by NVD and additionally CWE-122 (Heap-based Buffer Overflow) by Microsoft's advisory, meaning attacker-controlled input is not properly validated before being processed into a heap buffer, allowing memory corruption that can be leveraged to elevate privileges locally.

RemediationAI

Vendor-released patch: upgrade to .NET 8.0.27, 9.0.16, or 10.0.8 (or later) as appropriate for your runtime, updating the affected Microsoft.WindowsDesktop.App.Runtime.win-arm64/x64/x86 NuGet packages and redeploying dependent WPF applications; apply the latest Windows/.NET servicing update from Microsoft. Consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35433, the announcement at https://github.com/dotnet/announcements/issues/398, and the advisory https://github.com/dotnet/wpf/security/advisories/GHSA-8x9c-mqxv-q2pp. Because exploitation requires a user to open attacker-supplied input in an affected desktop application, where immediate patching is not possible reduce risk by restricting which untrusted files/inputs are opened by WPF/.NET desktop apps and by limiting execution to least-privilege user accounts to reduce the value of a local elevation; these controls reduce but do not eliminate exposure and may impact user workflows that legitimately open external files.