EUVD-2026-56770
GHSA-gg8c-3338-xw2f
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector confirmed by description; PR:N and UI:R because no privilege is needed but user must open malicious input; full C/I/A impact consistent with arbitrary code execution.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full code execution upon successful exploitation, with high impact across confidentiality, integrity, and availability. The vulnerability requires user interaction - such as opening a malicious file or running a crafted application - making social engineering a likely delivery vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | User interaction is required - specifically, a local user must open or process a malicious file or input that triggers the vulnerable .NET code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 with AV:L/AC:L/PR:N/UI:R reflects a locally exploitable vulnerability requiring user interaction but no prior privileges, with maximum impact across all three security dimensions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious file - such as a document, archive, or binary - designed to trigger the out-of-bounds write when processed by a .NET application. The attacker delivers it via phishing or a malicious download site, convincing the target user to open it. … |
| Remediation | The primary remediation is to apply Microsoft's official patch as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70354. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct comprehensive inventory of all Microsoft .NET installations across infrastructure and applications to determine exposure scope and criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Visual Studio 2022
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
HTTP request smuggling in System.Net.HttpListener across .NET 8.0, 9.0, and 10.0 enables unauthenticated remote attacker
.NET and Visual Studio Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is re
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this v
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today