EUVD-2026-73918
GHSA-fg32-9f4f-8w3f
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack requiring an existing low-privileged account and a specific high-complexity trigger condition; full C/I/A impact consistent with code injection achieving local privilege escalation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft .NET Runtime and Visual Studio exploits a code injection weakness (CWE-94) allowing a low-privileged authenticated local user to gain full system-level control over confidentiality, integrity, and availability. Affected versions span .NET 9.0, 10.0, and the pre-release 11.0 RC1, plus Visual Studio 2022 (17.14.x) and the pre-release Visual Studio 2026 (18.9.x). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated local user account with at least low-level privileges (PR:L) on a Windows system running a vulnerable version of .NET 9.0, 10.0, or 11.0 RC0, or Visual Studio 2022 17.14.x or Visual Studio 2026 18.9.x. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.0 (High), reflecting a realistic but non-trivial exploitation scenario: the attacker must already hold local access with low privileges and must meet a specific high-complexity condition (AC:H), suggesting a race condition, a particular configuration state, or a timing-dependent trigger. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Microsoft has released patches for all affected release branches and organizations should upgrade immediately. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an asset inventory to identify all systems running .NET Runtime versions 9.0, 10.0, or 11.0 RC1, and Visual Studio 2022 versions 17.14.x or later. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today