What is the CVSS score of EUVD-2026-56406?

EUVD-2026-56406 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of .NET Framework are affected by EUVD-2026-56406?

A critical security flaw in Microsoft .NET Framework and .NET runtimes exposes organizations to application-level compromise-any attacker with local access can execute malicious code within…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-56406?

Yes, a public proof-of-concept exploit is available for EUVD-2026-56406. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-56406?

Within 24 hours, conduct a comprehensive inventory of all systems running affected .NET Framework versions (3.5-4.8.1) and .NET runtimes (8.0, 9.0, 10.0) as well as Visual Studio 2022 and 2026 installations to determine organizational scope and system criticality. Within 7 days, prioritize patch deployment beginning with production systems; apply Microsoft's vendor-released patches across all affected product lines to eliminate the integer overflow vulnerability. Within 30 days, complete full validation of patched environments through testing of applications dependent on these .NET runtimes and document remediation completion across all systems.

.NET Framework EUVD-2026-56406

| CVE-2026-62897 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-08-11 secure@microsoft.com

GHSA-fx4q-gjrx-2jw6

Buffer Overflow Integer Overflow Microsoft Red Hat Visual Studio 2022 Net Net Framework Visual Studio 2026

7.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.0 HIGH

Local-only attack with high complexity and mandatory user interaction; no privileges required; full C/I/A process impact with no scope change to other systems.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 19:00 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.0

DescriptionCVE.org

Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.

AnalysisAI

Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process compromise (C:H/I:H/A:H) across a broad product surface spanning .NET Framework 3.5 through 4.8.1, .NET 8.0, 9.0, 10.0, and Visual Studio 2022 and 2026. An attacker who can deliver crafted input processed by a vulnerable .NET application can trigger arithmetic wraparound (CWE-190) to corrupt runtime memory and execute arbitrary code within the process context. Microsoft has released patches across all affected product lines; no public exploit identified at time of analysis, and no CISA KEV listing is present.

Technical ContextAI

CWE-190 (Integer Overflow or Wraparound) describes a condition where an arithmetic operation-typically a memory allocation size calculation-produces a result exceeding the maximum storable value of the integer type, wrapping around to a small or zero value. The resulting undersized allocation is subsequently written beyond its bounds, achieving memory corruption. The co-occurrence of the 'Buffer Overflow' tag alongside 'Integer Overflow' in the source data confirms this classic integer-to-heap-overflow escalation pattern. In the .NET ecosystem the vulnerability manifests across two distinct runtime generations: the legacy CLR-based .NET Framework (versions 3.5 through 4.8.1, identified by internal build strings such as 2.0.50727.x and 3.0.30729.x) and the modern cross-platform .NET runtime (8.0, 9.0, 10.0). The inclusion of Visual Studio 2022 (17.14) and Visual Studio 2026 (18.8) as affected products suggests the flaw resides in a shared SDK or compiler component consumed by both IDE versions. The vulnerability was reported by secure@microsoft.com (MSRC) and is tracked under EUVD-2026-56406 in the ENISA European Vulnerability Database.

RemediationAI

Apply Microsoft-released patches for each affected product line via Windows Update, the .NET release channel, or the Visual Studio updater. For .NET Framework 3.5 AND 4.7.2, update to 4.7.4144.0 (CLR 2.0.50727.9070 / 3.0.30729.9068). For .NET Framework 3.5 standalone, update to 2.0.50727.9183 or 3.0.30729.9169. For .NET Framework 3.5 AND 4.8, update to 4.8.4805.0. For .NET Framework 4.8.1, update to 4.8.9344.0. For modern .NET, upgrade to .NET 8.0.30, .NET 9.0.19, or .NET 10.0.11 via dotnet CLI or NuGet channel updates. For Visual Studio 2022 17.14, update to 17.14.38; for Visual Studio 2026 18.8, update to 18.8.3. The full advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62897. Where immediate patching is not feasible, deploy application control policies (AppLocker or Windows Defender Application Control) to restrict execution of untrusted .NET binaries; note this trade-off reduces operational flexibility and does not mitigate exploitation via trusted but vulnerable application paths that users are permitted to run.