EUVD-2026-56685
GHSA-jqhp-238x-qhgf
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector with mandatory user interaction; no prior privileges needed; full CIA impact consistent with successful privilege escalation to elevated account.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results from a heap-based buffer overflow triggered by an integer overflow or wraparound condition in the runtime's memory handling. An unprivileged local user who interacts with a crafted input - such as a malicious file processed by a .NET application - can exploit the flaw to gain elevated privileges on the host system. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available from Microsoft.
Technical ContextAI
The root cause is a CWE-122 (Heap-based Buffer Overflow) triggered by an integer overflow or wraparound, a well-documented exploitation chain in which an arithmetic overflow in a size or length calculation causes an undersized heap allocation; subsequent writes to that buffer exceed its actual bounds, corrupting adjacent heap memory. This corruption can overwrite heap metadata, function pointers, or security-critical structures to achieve privilege escalation. The vulnerability is tagged as both 'Heap Overflow' and 'Buffer Overflow,' consistent with this two-stage mechanism: integer wraparound as root cause, heap corruption as the exploitable consequence. Affected products span the .NET 8.0, 9.0, and 10.0 managed runtime families as well as the bundled runtimes shipped with Microsoft Visual Studio 2022 (17.14.x series) and Visual Studio 2026 (18.8.x series), as confirmed by EUVD-2026-56685 version data.
RemediationAI
The primary fix is to upgrade to the patched releases published by Microsoft and detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62886. Exact fix versions are: .NET 8.0.30, .NET 9.0.19, .NET 10.0.11, Visual Studio 2022 17.14.38, and Visual Studio 2026 18.8.3. Updates can be applied via Windows Update, the Microsoft Update Catalog, or package managers such as winget, apt, or yum depending on the deployment platform; use 'dotnet --version' and 'dotnet --list-runtimes' to confirm installed versions before and after patching. Where immediate patching is not feasible, restricting interactive local user access to systems running vulnerable .NET workloads and blocking untrusted file or input processing through application-layer controls can reduce exposure surface, though these are partial measures that do not eliminate the underlying flaw and may impact application functionality.
More in Visual Studio 2022
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove
Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Decompression bomb (CWE-409) in ASP.NET Core allows unauthenticated remote attackers to exhaust server resources and den
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today