What is the CVSS score of CVE-2026-50649?

CVE-2026-50649 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of .NET are affected by CVE-2026-50649?

Microsoft .NET 8.0 and 9.0 contain a critical vulnerability that could allow attackers to take control of production applications when users open malicious files-affecting all organizations running…. A patch is available.

How to fix or mitigate CVE-2026-50649?

Within 24 hours, inventory all systems running .NET 8.0, .NET 9.0, or Visual Studio 2022/2026, and restrict access to untrusted serialized data files from email and external sources. Within 7 days, apply vendor-released patches to all identified systems by consulting Microsoft Security Advisories for the specific versions required for .NET 8.0/9.0 and Visual Studio 2022/2026 in your environment. Within 30 days, review audit logs on previously-unpatched systems for evidence of exploitation attempts or suspicious process execution, confirm all applications have been restarted with the patched runtime, and document remediation completion.

.NET CVE-2026-50649

EUVD-2026-44399 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-14 microsoft

Deserialization Microsoft Red Hat Suse Net 8 0 Net 9 0 Microsoft Visual Studio 2022 Version 17 12 Microsoft Visual Studio 2022 Version 17 14 Microsoft Visual Studio 2026 Version 18 7

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.8 HIGH

Local delivery of a serialized payload (AV:L) requiring a user to open it (UI:R), no privileges needed (PR:N), yielding full code execution at user context (C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:43 vuln.today

CVE Published

Jul 14, 2026 - 19:29 nvd

HIGH 7.8

DescriptionCVE.org

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft .NET 8.0 and 9.0 (and bundled Visual Studio 2022/2026 toolchains) arises from unsafe deserialization of untrusted data (CWE-502), letting an unprivileged local attacker run arbitrary code in the context of the targeted process once a user is lured into opening or processing a malicious serialized payload. The CVSS 3.1 base score is 7.8 with high impact to confidentiality, integrity, and availability, but the vector (AV:L/UI:R) confines it to local attacks that require user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The root cause is CWE-502 Deserialization of Untrusted Data within the .NET runtime/framework. Deserialization flaws occur when an application reconstructs objects from attacker-controlled serialized input without validating type or content, allowing a crafted payload to instantiate unexpected types or trigger dangerous callbacks (gadget chains) that culminate in code execution. Per the CPE data the affected surface is the Microsoft .NET runtime versions 8.0 and 9.0 (cpe:2.3:a:microsoft:.net_8.0 and .net_9.0), and the flaw is redistributed through the Visual Studio toolsets that ship these runtimes: Visual Studio 2022 versions 17.12 and 17.14 and Visual Studio 2026 version 18.7. Because .NET is a broad application platform, the vulnerable deserialization path would be reachable by any application built on or executing under the affected runtime that deserializes external input.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security updates for the affected .NET 8.0 and 9.0 runtimes and update Visual Studio 2022 (17.12 and 17.14) and Visual Studio 2026 (18.7) to the fixed builds published in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50649; the input does not include a specific fixed version string, so retrieve the exact patched build from that advisory. Update both self-contained applications (which embed their own runtime and must be rebuilt/redeployed) and framework-dependent apps that rely on the machine-wide runtime. Where immediate patching is not possible, reduce exposure by avoiding deserialization of untrusted input in affected applications - prefer safe serializers such as System.Text.Json over BinaryFormatter/legacy binary deserialization, and restrict which users can supply serialized files to the affected processes; the trade-off is that changing serializers may require application code changes and testing, and restricting file sources depends on organizational workflow controls.