What is the CVSS score of CVE-2026-70354?

CVE-2026-70354 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft .NET are affected by CVE-2026-70354?

A critical vulnerability in Microsoft .NET (CVE-2026-70354) enables local attackers to achieve full code execution through malicious files or applications, potentially compromising confidentiality,…. A patch is available.

Is there a public PoC exploit available for CVE-2026-70354?

Yes, a public proof-of-concept exploit is available for CVE-2026-70354. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-70354?

Within 24 hours, conduct comprehensive inventory of all Microsoft .NET installations across infrastructure and applications to determine exposure scope and criticality. Within 7 days, implement compensating controls including restricting end-user permissions for running untrusted applications, disabling .NET execution in sandboxed environments where feasible, deploying advanced endpoint protection with behavior monitoring, and conducting targeted security awareness training on malicious file risks. Within 30 days, establish process to monitor Microsoft Security Response Center advisories for patch release, conduct lab testing of patches immediately upon availability, and plan staged deployment across production systems prioritizing critical applications.

Microsoft .NET CVE-2026-70354

EUVD-2026-56770 HIGH

Out-of-bounds Write (CWE-787)

2026-08-11 secure@microsoft.com

GHSA-gg8c-3338-xw2f

Buffer Overflow Memory Corruption Microsoft Red Hat Visual Studio 2022 Net Net Framework Visual Studio 2026

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.8 HIGH

Local vector confirmed by description; PR:N and UI:R because no privilege is needed but user must open malicious input; full C/I/A impact consistent with arbitrary code execution.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 17:46 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 7.8

DescriptionNVD

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full code execution upon successful exploitation, with high impact across confidentiality, integrity, and availability. The vulnerability requires user interaction - such as opening a malicious file or running a crafted application - making social engineering a likely delivery vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Microsoft Security Response Center has acknowledged the issue.

Technical ContextAI

CWE-787 (Out-of-Bounds Write) describes a memory corruption class where a program writes data beyond the allocated buffer boundary. In .NET runtimes or associated native components, this type of flaw typically arises in parsers, format handlers, or interop layers that process attacker-supplied input without sufficient bounds checking. The result is heap or stack corruption that can be leveraged to overwrite adjacent memory structures, redirect execution flow, or achieve arbitrary code execution. The CVSS vector (AV:L) indicates the exploitation surface is local - the attacker must be able to execute code or supply input on the target system, consistent with a file-format or local API parsing vulnerability.

RemediationAI

The primary remediation is to apply Microsoft's official patch as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70354. An exact fixed version number was not confirmed in the available intelligence - consult the advisory directly to identify the minimum safe .NET runtime and SDK versions for your environment. As an interim measure prior to patching, restrict execution of untrusted files and documents on systems running .NET, and enforce application allowlisting to prevent execution of unsigned or unknown binaries. User awareness around opening files from untrusted sources reduces the UI:R exploitation vector. Disabling unnecessary .NET features or sandboxing applications that process external input may reduce exposure but carries compatibility trade-offs.