.NET EUVD-2026-99699

Requires an attacker with an existing low-privileged local account on a host running an affected .NET runtime/SDK (.NET 9.0 <9.0.319/9.0.122, 10.0 <10.0.113, 11.0 <11.0.100-rc.2) or Visual Studio (2022 17.14 <17.14.42, 2026 18.10 <18.10.4), plus the ability to create symbolic links or junctions and win a time-of-check/time-of-use race during a privileged .NET file operation. Exploitation is limited by three factors from the CVSS vector: local access only (AV:L), pre-existing low privileges (PR:L), and required user/process interaction to trigger the vulnerable file operation (UI:R); these constraints, combined with SSVC Automatable 'no', make reliable exploitation difficult.

This is a locally-exploitable elevation-of-privilege flaw (CVSS 7.3) rather than a remote threat: the CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H confirms local attack vector, low attacker privileges already required, and mandatory user interaction, which materially constrains real-world risk. The signals are consistent and point to LOW urgency: CISA's SSVC assessment lists Exploitation as 'none' and Automatable as 'no' (link-following TOCTOU races are inherently not reliably automatable), there is no CISA KEV listing, no EPSS score was supplied, and no public exploit was provided in the input - so this is 'no public exploit identified at time of analysis.' The one amplifying signal is SSVC Technical Impact of 'total', which aligns with the C:H/I:H/A:H impact. Net assessment: a legitimate issue worth patching on a normal cadence, but not an emergency - it is a high-CVSS score driven by total technical impact, offset by local access, prior privileges, required user interaction, and no evidence of exploitation. Note a tagging conflict to verify: the input Tag says 'Information Disclosure' while the description and CWE-59 describe local privilege escalation - treat this as an elevation-of-privilege flaw, not info disclosure.

A low-privileged but authenticated local user on a system with an affected .NET runtime/SDK or Visual Studio plants a symbolic link (or junction) in a path a higher-privileged .NET process will operate on, then induces that operation so the file access is redirected to a protected location, letting the attacker write, overwrite, or read privileged files and escalate. The attack is local only, requires the victim/service to perform the triggering action (UI:R), and no public exploit code was identified at the time of analysis.