.NET CVE-2026-70161

Requires local access as an already-authorized user (PR:L) and user interaction (UI:R) - a higher-privileged user or process must be induced to act on the attacker-influenced path, so this is not remotely triggerable. The attacker must be able to supply or influence a pathname processed by vulnerable .NET components or Visual Studio. Affected and unpatched builds are required: .NET 9.0 (<9.0.319/9.0.122), .NET 10.0 (<10.0.402), .NET 11.0 (<11.0.100-rc.2), Visual Studio 2022 17.14 (<17.14.42), and Visual Studio 2026 18.10 (<18.10.4); updating to the fixed versions removes the condition. Limiting factors: local-only vector, prior authenticated foothold, and the required interaction by a privileged party substantially narrow realistic exploitation to developer/build environments.

This is a moderate-priority local privilege-escalation issue rather than an urgent, widely-exploitable threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, 7.3) describes a local attack requiring an already-authorized user (PR:L) and user interaction (UI:R), which materially limits remote mass-exploitation despite the 'total' technical impact (full C/I/A compromise within the unchanged scope). CISA's SSVC framework reinforces a lower urgency: Exploitation=none, Automatable=no, Technical Impact=total - i.e., high damage potential but no observed exploitation and no automated/wormable path. There is no KEV listing and no public exploit identified, so per precision rules this is 'no public exploit identified at time of analysis.' EPSS is not provided in the input, so exploitation probability cannot be quantified. The signals are internally consistent (local vector + no exploitation + not automatable all point to a developer-workstation/build-time EoP), so this is a genuine but patch-on-normal-cycle issue, not a high-CVSS-but-illusory one. Note the impact fields (C:H/I:H/A:H) are elevated while the vector is local and interaction-gated - verify the realistic blast radius against the vendor advisory.

A local, already-authenticated attacker on a developer workstation or build server places or manipulates a crafted path/artifact so that a .NET or Visual Studio operation resolves it outside the intended restricted directory; when a higher-privileged user or process is induced to act on it (UI:R), the traversal writes or overwrites files in a privileged location, elevating the attacker's privileges. No public exploit code is identified at time of analysis.