Microsoft .NET EUVD-2026-100208

Exploitation requires that a vulnerable .NET application process attacker-supplied, malformed input that reaches the vulnerable code path performing the out-of-bounds write (CWE-787); the CVSS UI:R metric confirms a victim action (opening/processing the crafted content) is mandatory, so this cannot be triggered purely passively against an idle service. No authentication is needed (PR:N) and the attack is network-deliverable (AV:N) with low complexity (AC:L). The key limiting factors are: (1) the required user/application interaction to process the malicious input, and (2) the target must run an unpatched build within the affected ranges (.NET 8.0 <8.0.32, 9.0 <9.0.21, 10.0 <10.0.13, 11.0 <11.0.0-rc.2, or Visual Studio 17.14 <17.14.42 / 18.10 <18.10.4). The precise input format/feature that triggers the flaw is not specified in the available description.

This is a genuinely high-priority, patch-worthy flaw but with important caveats that lower its real-world urgency relative to its 8.8 CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated out-of-bounds write (CWE-787) yielding full CIA impact - i.e., remote code execution. The single most important mitigating signal is UI:R: exploitation requires a victim to process attacker-controlled input, so this is not a wormable, zero-click server flaw. CISA's SSVC framework reinforces a measured posture: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably mass-exploited, consistent with the UI:R requirement), and Technical Impact=total (confirming the RCE-class consequence if triggered). No EPSS score, no KEV listing, and no POC were provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' Signals are therefore consistent rather than conflicting: high technical impact but currently no evidence of exploitation and a non-automatable, user-interaction-gated attack path. Bottom line - prioritize patching because the affected platform is extremely widespread and the impact is total, but this is not an actively-exploited emergency at the time of analysis.

An attacker crafts a malicious input (e.g., a file, serialized payload, or network message) processed by a vulnerable .NET application; when a user or application opens/processes it, the out-of-bounds write corrupts memory and leads to arbitrary code execution in the context of the .NET process. No authentication is required (PR:N), but the victim must take an action to process the content (UI:R). No public exploit code was identified in the provided intelligence.