Microsoft .NET CVE-2026-58641

Local access to the target machine is required (AV:L). The victim must perform an action such as running a malicious .NET executable or opening a crafted file processed by the .NET runtime (UI:R from CVSS vector). No prior privileges are required to initiate the attack (PR:N), meaning even a restricted local user account - or a user induced to run an untrusted binary - can trigger the condition. Exploitation is limited by: (1) the requirement for physical or network-authenticated local session access, ruling out fully remote unauthenticated attack paths; (2) the user interaction requirement, which introduces a social engineering dependency; and (3) the need for an affected .NET runtime version (8.0.0-8.0.29, 9.0.0-9.0.18, or 10.0.0-10.0.10) to be installed on the target. Specific .NET subsystem or feature required to trigger the overflow is not confirmed from available data.

The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) signals a high-severity local privilege escalation requiring user interaction but no prior privileges. The PR:N rating is notable: it indicates that no authenticated session or special role is needed to initiate the exploit - any local user who executes a crafted .NET application or opens a malicious file can trigger the condition. AC:L confirms the overflow is reliably reproducible without unusual target-side conditions. The UI:R constraint reduces real-world risk compared to a fully autonomous exploit, as some victim action (e.g., running an untrusted binary or opening a crafted file) is required. No EPSS data was provided; no CISA KEV listing exists at time of analysis; no public POC has been identified. SSVC signals: exploitation status is unproven, the attack is not automatable due to UI:R, and technical impact is total (C:H/I:H/A:H). Overall this is a genuine patching priority for environments running any of the three affected .NET versions, particularly those that allow untrusted local code execution or shared user workstations, but it is not an emergency zero-day scenario based on available signals.

A local attacker places or social-engineers a victim into executing a crafted .NET application on a shared workstation or terminal server running an unpatched .NET 8.0, 9.0, or 10.0 runtime. The malicious application triggers an integer overflow in the runtime's internal arithmetic, corrupting memory in a way that bypasses privilege boundaries and grants the attacker elevated - potentially SYSTEM-level - execution rights. No public proof-of-concept has been identified at time of analysis, but the low attack complexity rating suggests the overflow condition is reliably triggerable once a working exploit is developed.