EUVD-2026-56408Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable unauthenticated path with high-complexity gate; impact is confidentiality-only with no integrity or availability dimension, unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in Microsoft .NET (versions 8.0.0-8.0.29, 9.0.0-9.0.18, and 10.0.0-10.0.10) and Visual Studio 2022/2026 exposes sensitive data over the network due to improper sanitization of information prior to network transfer, classified under CWE-212. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates unauthenticated network exploitation gated by high attack complexity, yielding full confidentiality compromise (C:H) with no integrity or availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-reachable, unauthenticated exploitation with no user interaction required, but high attack complexity means the attacker must satisfy additional conditions beyond simple network reachability - likely involving a specific application state, timing window, or request sequence in the .NET runtime. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.9 Medium score captures a constrained risk profile: the network attack vector (AV:N) and absence of required privileges (PR:N) or user interaction (UI:N) lower the access barrier, but the high attack complexity (AC:H) substantially reduces the practical likelihood of successful exploitation and is directly corroborated by the CISA SSVC 'Automatable: no' rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker with network access to a vulnerable .NET application endpoint identifies or induces the specific application state required by the high-complexity attack conditions, then sends a crafted or precisely timed request to trigger the code path where sensitive data is improperly included in a network transmission. The attacker captures the leaked information - potentially credentials, tokens, or other sensitive runtime data - from the response. … |
| Remediation | The primary fix is to upgrade to the vendor-released patched versions: .NET 8.0 users should update to 8.0.30 or later; .NET 9.0 users should update to 9.0.19 or later; .NET 10.0 users should update to 10.0.11 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Visual Studio 2022
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
HTTP request smuggling in System.Net.HttpListener across .NET 8.0, 9.0, and 10.0 enables unauthenticated remote attacker
.NET and Visual Studio Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is re
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today