.NET Runtime EUVD-2026-99693

Exploitation requires the attacker to already possess local low-privileged access to a system running an affected .NET runtime (9.0 before 9.0.319/9.0.122, 10.0 before 10.0.402, 11.0 before 11.0.100-rc.2) or Visual Studio (2022 17.14 before 17.14.42, 2026 18.10 before 18.10.4), and to abuse improper link resolution (CWE-59) by planting a symbolic or hard link that a higher-privileged .NET file operation then follows. Exploitation is LIMITED by three factors drawn directly from the CVSS vector: it is local-only (AV:L, not remotely reachable), requires valid authentication/privileges to run code on the host (PR:L), requires user or privileged-process interaction to trigger the link-following operation (UI:R), and has high attack complexity (AC:H) implying a race condition or specific precondition that the attacker cannot control reliably - consistent with SSVC Automatable=no.

This is a moderate, conditional local privilege-escalation issue rather than a top-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:R/S:U, C:H/I:H/A:H, base 6.7) describes an attacker who must already have local, authenticated access (PR:L), win a race or meet specific preconditions (AC:H), AND rely on user interaction (UI:R) - three distinct barriers that substantially lower real-world exploitability. These limiters are reinforced by CISA's SSVC decision: Exploitation=none (no observed activity), Automatable=no (cannot be reliably scripted at scale), even though Technical Impact=total (full compromise of the component once achieved). The signals are internally consistent: high technical impact but low ease-of-exploitation, which is the classic profile of a flaw that is dangerous in a targeted post-access scenario but not a mass-exploitation threat. No EPSS score was supplied, the CVE is not in CISA KEV, and no POC is referenced, so there is no exploitation-pressure signal to override the SSVC 'none' finding. Note one metadata inconsistency to verify: the input Tag labels this 'Information Disclosure,' but the description, CWE-59 (link following), and the C:H/I:H/A:H impact all describe elevation of privilege - treat the tag as mislabeled, not as evidence of a disclosure-only impact.

A low-privileged local user (or a low-privileged process) on a machine running an affected .NET runtime or Visual Studio installation plants a malicious symbolic/hard link so that a higher-privileged .NET operation follows it to an attacker-controlled target, redirecting a privileged file write or access. By inducing the required user or privileged-process action (UI:R) and winning the associated race/precondition window (AC:H), the attacker causes the operation to act on a path they control and gains elevated privileges. No public exploit code is referenced for this CVE.