Microsoft .NET EUVD-2026-99752

Exploitation requires an attacker to deliver crafted content that is processed by a vulnerable .NET runtime or application, and per the CVSS UI:R flag a legitimate user must interact with that content (open/load the malicious file or data) for the out-of-bounds write to trigger - fully unattended exploitation is not indicated. The attacker is unauthenticated (PR:N) and the vector is network-reachable (AV:N) with low attack complexity (AC:L). Limiting factors: the mandatory user interaction, and that the host must run an affected, unpatched version - .NET Framework below the listed build thresholds (e.g., 4.8 <4.8.4811.0, 4.8.1 <4.8.9363.0), .NET 8.0 <8.0.32, 9.0 <9.0.21, 10.0 <10.0.13, 11.0 <11.0.0-rc.2, or Visual Studio 2022 <17.14.42 / 2026 <18.10.4. CISA SSVC rates this non-automatable, so it does not lend itself to wormable or mass-automated exploitation.

Signals are mixed and should temper the raw 8.8 'High' score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated code-execution flaw with total impact (C:H/I:H/A:H), which on its face is a serious RCE in an extremely widely-deployed framework. However, the vector requires user interaction (UI:R), meaning a victim must open or process attacker-supplied content rather than the bug being exploitable fully unattended. CISA's SSVC framework contradicts the urgency implied by the score: Exploitation is rated 'none' (no observed exploitation) and Automatable is 'no', even though Technical Impact is 'total' - this combination points to a high-impact but not yet weaponized or self-propagating issue. No EPSS probability was provided in the input, and there is no CISA KEV listing and no public exploit, so there is no public exploit identified at time of analysis. Net assessment: patch on a normal-to-expedited cadence given .NET's ubiquity and the RCE potential, but this is not an emergency drop-everything item in the way an actively-exploited, automatable, no-user-interaction RCE would be. Note the tension to verify: the description calls the actor 'unauthorized' (consistent with PR:N) yet exploitation still hinges on user interaction, so realistic attacks require luring a victim.

An attacker crafts malicious input (e.g., a file, document, or data stream processed by a vulnerable .NET application) that triggers the out-of-bounds write (CWE-787) when a user opens or loads it. Because the CVSS vector specifies UI:R, the victim must interact with the attacker-supplied content; successful exploitation corrupts memory and yields arbitrary code execution in the context of the affected application. No public proof-of-concept or exploit code was identified in the provided data.