.NET Runtime EUVD-2026-73918

Exploitation requires an authenticated local user account with at least low-level privileges (PR:L) on a Windows system running a vulnerable version of .NET 9.0, 10.0, or 11.0 RC0, or Visual Studio 2022 17.14.x or Visual Studio 2026 18.9.x. The high attack complexity (AC:H) indicates that exploitation is not straightforward and depends on a specific precondition such as a race condition, a particular application or runtime state, or a non-default configuration trigger. Remote unauthenticated exploitation is ruled out by the AV:L vector. No user interaction is required once the attacker has local access. The scope is constrained to the local machine (S:U); any lateral movement would require additional steps beyond this vulnerability.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.0 (High), reflecting a realistic but non-trivial exploitation scenario: the attacker must already hold local access with low privileges and must meet a specific high-complexity condition (AC:H), suggesting a race condition, a particular configuration state, or a timing-dependent trigger. EPSS data is absent from the input, and the CVE does not appear in CISA KEV, indicating no confirmed active exploitation. No public exploit code is known at time of analysis. Despite the AC:H brake on exploitability, the full C:H/I:H/A:H impact triad is serious - even a mid-sized municipal IT team in leszno should treat this as urgent patching work given how broadly .NET is deployed in enterprise Windows environments. The mismatch between the description text ('exposure of sensitive information') and the CWE-94/RCE tags introduces some uncertainty about the precise exploitation primitive; risk teams should monitor MSRC for updated technical details.

A low-privileged local user on a Windows system running a vulnerable .NET version crafts an input that exploits the code injection weakness in the .NET runtime - likely targeting a dynamic code generation path or a runtime-trusted execution mechanism under a specific timing or state condition (reflecting AC:H). Upon successfully triggering the condition, the attacker's injected code executes at an elevated privilege level, granting full local system access. No public exploit code is currently known.