CVE-2026-32177

highpriority · track · 0EPSS 0.006 · 50 %ileDEEUJPNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.64% (50th) EPSS

CVSS 7.3 · high

Is it mine?

120 products

Check your exposure

Who says so?

8 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixed.NET 10.0 installed on Windowsmsrc_csaf
10.0.8:Security Update:https://support.microsoft.com/help/5093446
https://support.microsoft.com/help/5093446
Fixed.NET 8.0 installed on Windowsmsrc_csaf
8.0.27:Security Update:https://support.microsoft.com/help/5093447
https://support.microsoft.com/help/5093447
Fixed.NET 9.0 installed on Windowsmsrc_csaf
9.0.16:Security Update:https://support.microsoft.com/help/5093448
https://support.microsoft.com/help/5093448
FixedMicrosoft .NET Framework 3.5msrc_csaf
4.8.9334.0 and 4.8.4802.0:Security Update:https://support.microsoft.com/help/5087048
https://support.microsoft.com/help/5087048
FixedMicrosoft .NET Framework 3.5 AND 4.7.2msrc_csaf
4.8.9334.0 and 4.8.4802.0:Security Update:https://support.microsoft.com/help/5087061
https://support.microsoft.com/help/5087061
FixedMicrosoft .NET Framework 3.5 AND 4.8msrc_csaf
4.8.9334.0 and 4.8.4802.0:Security Update:https://support.microsoft.com/help/5087064
https://support.microsoft.com/help/5087064
FixedMicrosoft .NET Framework 3.5 AND 4.8.1msrc_csaf
4.8.9334.0 and 4.8.4802.0:Security Update:https://support.microsoft.com/help/5087051
https://support.microsoft.com/help/5087051
FixedMicrosoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2msrc_csaf
4.8.9334.0 and 4.8.4802.0:Security Update:https://support.microsoft.com/help/5087062
https://support.microsoft.com/help/5087062
FixedMicrosoft .NET Framework 4.8msrc_csaf
4.8.9334.0 and 4.8.4802.0:Security Update:https://support.microsoft.com/help/5087065
https://support.microsoft.com/help/5087065
FixedMicrosoft Visual Studio 2022 version 17.12msrc_csaf
17.12.20:Security Update:https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes-v17.12
https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes-v17.12
FixedMicrosoft Visual Studio 2022 version 17.14msrc_csaf
17.14.32:Security Update:https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
FixedMicrosoft Visual Studio 2026 version 18.5msrc_csaf
18.5.3:Security Update:https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes
https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes

cvss

Technical severity, 0–10. One row per scoring source.

7.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.3highAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Lsecondary · FSTEC (BDU) RU

v3.17.3highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:Csecondary · ENISA EU

v3.17.3highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Lsecondary · secure@microsoft.com USexploitability 1.8 · impact 5.5

v3.17.3highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Lsecondaryexploitability 1.8 · impact 5.5

v3.17.3highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:Csecondary · NCSC-NL NL

v3.17.3highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:Csecondary · Microsoft Security Response Center US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-122USCWE-122USCWE-122USCWE-122USCWE-20USCWE-20USCWE-787US

affected products (120)

Products and version ranges known to be affected.

Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Microsoft .NET 10.0all versionscert_bundDEcpe:/a:microsoft:.net:10.0
Microsoft .NET 8.0all versionscert_bundDEcpe:/a:microsoft:.net:8.0
Microsoft .NET 9.0all versionscert_bundDEcpe:/a:microsoft:.net:9.0
Microsoft .NET Framework 3.5all versionscert_bundDEcpe:/a:microsoft:.net_framework:3.5:-
Microsoft .NET Framework 4.7.2all versionscert_bundDEcpe:/a:microsoft:.net_framework:4.7.2
Microsoft .NET Framework 4.8all versionscert_bundDEcpe:/a:microsoft:.net_framework:4.8
Microsoft .NET Framework 4.8.1all versionscert_bundDEcpe:/a:microsoft:.net_framework:4.8.1
Microsoft Azure DevOpsall versionscert_bundDEcpe:/a:microsoft:azure:devops
Microsoft Visual Studio 2017 version 15.9 (includes 15.0-15.8)all versionscert_bundDE
Microsoft Visual Studio 2019 version 16.11 (includes 16.0-16.10)all versionscert_bundDE
Microsoft Visual Studio 2022 version 17.12all versionscert_bundDE
Microsoft Visual Studio 2022 version 17.14all versionscert_bundDE
Microsoft Visual Studio 2026 version 18.5all versionscert_bundDE
Microsoft Visual Studio Codeall versionscert_bundDEcpe:/a:microsoft:visual_studio_code:-
Microsoft Visual Studio Code - Live Preview extensionall versionscert_bundDEcpe:/a:microsoft:visual_studio_code:-_live_preview_extension
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Microsoft Visual Studio 2017≤ version 15.9 (includes 15.0-15.8)cert_bundDE

showing 20 of 120

advisories (6)

Vendor and ecosystem advisories describing this.

NCSC-2026-0143Kwetsbaarheden verholpen in Microsoft Developer ToolsNL2026-05-12csaf · ncsc_nlNL
Microsoft heeft kwetsbaarheden verholpen in diverse Developer Tools.
WID-SEC-W-2026-1488Microsoft Developer Tools: Mehrere SchwachstellenDeutsch2026-05-12csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio, Microsoft Visual Studio Code, Microsoft .NET Framework und Microsoft .NET ausnutzen, um beliebigen Programmcode auszuführen, um Daten zu manipulieren, um seine Privilegien zu erhöhen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.
msrc_CVE-2026-32177.NET Elevation of Privilege Vulnerability2026-05-12csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
BIT-dotnet-2026-32177.NET Elevation of Privilege Vulnerability2026-06-22vendor · osvUS
Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
BIT-dotnet-sdk-2026-32177.NET Elevation of Privilege Vulnerability2026-06-22vendor · osvUS
Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
JVNDB-2026-024104JVN iPedia advisory JVNDB-2026-0241042026-07-17vendor · jvndbJP

also known as (5)

Other names and identifiers for this entity.

CNNVD-202605-2683 cnnvd
EUVD-2026-29572 enisa_euvd
BDU:2026-06742 fstec_bdu
BIT-dotnet-2026-32177osv
BIT-dotnet-sdk-2026-32177osv

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund ncsc_nl msrc_csaf jvndb NVD CVE.org MITRE

published 2026-05-12modified 2026-07-15

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan