Local privilege escalation from sensitive information exposure in Microsoft.NET and Visual Studio

Exposure of sensitive information to an unauthorized actor in.NET allows an authorized attacker to elevate privileges locally.

Microsoft identifies the following affected scopes and corresponding fixed releases:

• .NET 9.0 installed on Linux: versions from 9.0.0 through less than 9.0.20 are affected; 9.0.20 is the identified fixed release.
• .NET 10.0 installed on Linux: versions from 10.0.0 through less than 10.0.12 are affected; 10.0.12 is the identified fixed release.
• .NET 11.0 installed on Linux: versions from 11.0.0 through less than 11.0 RC1 are affected; 11.0 RC1 is the identified fixed release.
• Microsoft Visual Studio 2022 version 17.14: versions from 17.14.0 through less than 17.14.40 are affected; 17.14.40 is the identified fixed release.
• Microsoft Visual Studio 2026 version 18.9: versions from 18.9.0 through less than 18.9.3 are affected; 18.9.3 is the identified fixed release.

The status of other branches or products is not established by the available evidence.

The weakness is described as exposure of sensitive information to an unauthorized actor and is also mapped to CWE-94, improper control of code generation. The affected scope includes Microsoft.NET installed on Linux and the specified Visual Studio branches. An attacker must already have local access with low privileges; the recorded attack path has high complexity and requires no user interaction. If successfully exploited, the exposed information may support local privilege elevation, with possible follow-on control of protected data, code, or system resources. The available evidence does not identify the exact sensitive data, vulnerable component, code-generation operation, or sequence linking disclosure to the privilege transition, so those details should not be assumed.

The attack vector is local, requires low privileges, has high complexity, and does not require user interaction. The record does not establish remote reachability or a separate authentication bypass. public_exploit is false, and no known exploitation status is confirmed; the evidence identifies no specific exploit, campaign, victim, or indicator. A CISA enrichment present in the returned record labels exploitation as none and automatable as no, but that status should not be treated as proof that exploitation can never occur.

Successful exploitation could expose sensitive information and allow the attacker to elevate local privileges. The assessed technical consequences are high for confidentiality, integrity, and availability, while the scope remains unchanged within the same system. Organizational consequences may include unauthorized access to local secrets, modification of code or configuration, and workload disruption depending on the privileges obtained. The impact is limited by the requirement for local access and a low-privilege authorized account; remote exploitation is not established.

Successful exploitation could expose sensitive information and elevate the privileges of a local account on the affected host. This may allow unauthorized access to local secrets, modification of software or host state, and service disruption depending on the privileges obtained. Development workstations, build systems, and Linux servers running.NET may face operational risk if a low-privilege local account is compromised. The risk is constrained by the requirement for local access and an authorized low-privilege starting position; the available evidence does not confirm a remote intrusion scenario.

1. Update Microsoft.NET by branch: use 9.0.20 for.NET 9.0 on Linux, 10.0.12 for.NET 10.0 on Linux, and 11.0 RC1 for.NET 11.0 on Linux.
2. Update Microsoft Visual Studio by branch: use 17.14.40 for Microsoft Visual Studio 2022 version 17.14 and 18.9.3 for Microsoft Visual Studio 2026 version 18.9.
3. Check runtimes, SDKs, targeting packs, and side-by-side installations so that the components actually used by applications are updated, rather than updating only an unused installation.
4. Prioritize Linux systems, developer workstations, and build systems where low-privilege local users can access sensitive data or code.
5. Do not assume that parallel branches or other releases are fixed because one branch has a fix. Verify unlisted branches separately with Microsoft.

1. Inventory Linux systems running.NET, including runtimes, SDKs, and side-by-side installations, then compare each branch and version with the boundaries in affected_summary.
2. Inventory Microsoft Visual Studio installations on workstations and build systems, and verify each installation against the corresponding fixed release in remediation.
3. Confirm deployment through software inventory, package status, or product-reported version information. Do not infer safety merely because a partial update was installed.
4. As a precaution, review local privilege changes, unusual access to sensitive data, and unauthorized modifications to code or host state on affected systems.
5. No CVE-specific IOC or log event is provided in the available evidence. Monitoring in the preceding step is precautionary, and the absence of observed indicators does not prove that a system is safe.