EUVD-2026-44399Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to target host
-
DeliveryDeliver crafted serialized payload to user
-
ExploitUser opens/processes malicious data
-
ExecutionTrigger unsafe .NET deserialization gadget chain
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local delivery of attacker-controlled serialized data to an application running on the affected .NET 8.0/9.0 runtime (or the bundled Visual Studio toolsets) that deserializes untrusted input, and it requires user interaction (CVSS UI:R) - a victim must open or process the malicious payload for code execution to occur. No prior authentication or elevated privileges are needed (PR:N), and the resulting code runs at the invoking user's privilege level within an unchanged scope (S:U). Limiting factors: the attacker cannot exploit this remotely (AV:L), success is gated on the target application actually performing deserialization of external data, and the required user action reduces the chance of unattended/automated exploitation. |
| Impact | The 7.8 CVSS score is driven by high C/I/A impact, but the vector materially constrains real-world risk: AV:L means the attacker needs local access to the target, and UI:R means a user must take an action (e.g., open a crafted file or run a malicious application) for exploitation to succeed. PR:N indicates no pre-existing privileges are required, so the payload runs at the invoking user's privilege level rather than requiring authentication. No EPSS score was provided in the input, and the CVE is not in CISA KEV, so there is no evidence of active exploitation; no POC was referenced either. This profile - local vector plus required user interaction, no KEV, no POC - places it as a standard patch-in-cycle priority rather than an emergency, though the high technical impact (full code execution) warrants timely remediation, especially on developer workstations and build agents that routinely process untrusted projects or files. No signals in the input conflict; the main limitation is the absence of EPSS and any exploitation intelligence. |
| Exploit ScenarioDerived | An attacker crafts a malicious serialized payload and delivers it as a file or data stream to a victim who runs a .NET application (or opens a project in Visual Studio) that deserializes it; when the victim opens or processes the payload, the embedded gadget chain triggers arbitrary code execution at the victim's privilege level. No public POC was referenced, and the local vector plus required user interaction mean the attacker relies on social engineering or a poisoned artifact rather than remote automation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Local code execution in Microsoft .NET 8.0 and 9.0 (and bundled Visual Studio 2022/2026 toolchains) arises from unsafe deserialization of untrusted data (CWE-502), letting an unprivileged local attacker run arbitrary code in the context of the targeted process once a user is lured into opening or processing a malicious serialized payload. The CVSS 3.1 base score is 7.8 with high impact to confidentiality, integrity, and availability, but the vector (AV:L/UI:R) confines it to local attacks that require user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security updates for the affected .NET 8.0 and 9.0 runtimes and update Visual Studio 2022 (17.12 and 17.14) and Visual Studio 2026 (18.7) to the fixed builds published in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50649; the input does not include a specific fixed version string, so retrieve the exact patched build from that advisory. Update both self-contained applications (which embed their own runtime and must be rebuilt/redeployed) and framework-dependent apps that rely on the machine-wide runtime. Where immediate patching is not possible, reduce exposure by avoiding deserialization of untrusted input in affected applications - prefer safe serializers such as System.Text.Json over BinaryFormatter/legacy binary deserialization, and restrict which users can supply serialized files to the affected processes; the trade-off is that changing serializers may require application code changes and testing, and restricting file sources depends on organizational workflow controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502 Deserialization of Untrusted Data within the .NET runtime/framework. Deserialization flaws occur when an application reconstructs objects from attacker-controlled serialized input without validating type or content, allowing a crafted payload to instantiate unexpected types or trigger dangerous callbacks (gadget chains) that culminate in code execution. Per the CPE data the affected surface is the Microsoft .NET runtime versions 8.0 and 9.0 (cpe:2.3:a:microsoft:.net_8.0 and .net_9.0), and the flaw is redistributed through the Visual Studio toolsets that ship these runtimes: Visual Studio 2022 versions 17.12 and 17.14 and Visual Studio 2026 version 18.7. Because .NET is a broad application platform, the vulnerable deserialization path would be reachable by any application built on or executing under the affected runtime that deserializes external input.
Know when Net 8 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local delivery of a serialized payload (AV:L) requiring a user to open it (UI:R), no privileges needed (PR:N), yielding full code execution at user context (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.
Executive ViewAI
Microsoft .NET 8.0 and 9.0 contain a critical vulnerability that could allow attackers to take control of production applications when users open malicious files-affecting all organizations running .NET services and development teams using Visual Studio 2022/2026. No public exploits have been identified yet, though the vulnerability is likely to attract adversary attention given its technical characteristics and broad deployment footprint. Immediate patching of all affected systems is essential to prevent potential data breaches, system compromise, and operational disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
GitHub PoC
Exploit-DB