Executive brief
A security vulnerability exists in the Microsoft .NET framework, a widely used platform for building and running applications on Windows and other operating systems. An attacker who successfully exploits this flaw could gain higher-level system permissions than they should normally have. This could allow an unauthorized user to take control of an affected system or access restricted data, though it requires some form of user interaction to be successful.
Technical details
A heap-based buffer overflow vulnerability exists in Microsoft .NET due to improper input validation and integer overflow/wraparound issues (CWE-20, CWE-190). The vulnerability is triggered when the framework processes specifically crafted input, leading to memory corruption. An attacker can exploit this locally to achieve elevation of privilege. While the attack vector is local and requires no prior administrative permissions, it does require a user to perform an action (User Interaction: Required) to trigger the exploit. Microsoft has released security updates to address this issue via the MSRC Update Guide.
Affected products
- Microsoft .NET
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory: Initial advisory published by Microsoft
- 2026-06-01: other: Vulnerability description updated to specify heap-based buffer overflow