EUVD-2026-56606
GHSA-cmww-63fh-m29g
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector confirmed by description; PR:N reflects no prior account privileges needed to run a .NET application; UI:R required as victim must execute crafted payload; full C/I/A impact consistent with privilege escalation to elevated context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft .NET runtimes (versions 8.0, 9.0, and 10.0) enables a local attacker to gain elevated system privileges by triggering an integer overflow condition, requiring only user interaction and no prior authentication. The flaw carries a CVSS 7.8 score with high impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment of .NET across enterprise Windows and Linux environments makes this a meaningful patching priority.
Technical ContextAI
CWE-190 (Integer Overflow or Wraparound) describes a condition where arithmetic on an integer value produces a result outside the type's representable range, causing a wrap-around that can corrupt adjacent memory, bypass bounds checks, or produce incorrect allocation sizes. In a managed runtime like .NET, such flaws can undermine type safety or memory isolation guarantees that the runtime normally enforces. The vulnerability spans three actively supported .NET release trains: .NET 8.0 (LTS, current enterprise baseline), .NET 9.0, and .NET 10.0, covering a wide range of server, desktop, and cross-platform deployments. The reporting contact (secure@microsoft.com) confirms Microsoft as the coordinating vendor, and the ENISA EUVD ID EUVD-2026-56606 provides an EU-side tracking reference. Tags include both 'Integer Overflow' and 'Buffer Overflow', suggesting the integer miscalculation may produce an undersized buffer leading to a subsequent heap or stack overflow condition.
RemediationAI
Upgrade to .NET 8.0.30, .NET 9.0.19, or .NET 10.0.11 as appropriate for the installed runtime channel. Microsoft has released patches for all three supported release trains; the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58641 is the authoritative source for patch packages and installation instructions. On systems where immediate patching is not feasible, restrict local user access to prevent execution of untrusted .NET applications, enforce application allowlisting (e.g., Windows Defender Application Control or AppLocker) to block arbitrary binary execution, and monitor for unexpected privilege changes on endpoints running affected .NET versions. Note that application allowlisting may introduce friction for development environments and requires careful policy scoping. No workaround eliminates the underlying overflow - patching is the definitive fix.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. [CVSS 7.5 HIGH]
Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today