CVE-2026-70197

CVE-2026-70197 is an out-of-bounds write (CWE-787) in Microsoft .NET that lets an unauthorized attacker run code over the network. It is reachable remotely with no privileges and no user interaction, but attack complexity is high, and the impact is high for confidentiality, integrity, and availability (CVSS 3.1 base score 8.1). Successful exploitation can give the attacker code execution in the context of the vulnerable .NET process. The issue is tracked in the NuGet ecosystem and was assigned by Microsoft; the data does not name a specific component or version range. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Apply the Microsoft security update for the affected .NET packages as soon as it is published, prioritizing internet-facing services that process untrusted network input. Until a patch is confirmed installed, reduce exposure by limiting network access to .NET services and monitoring for crashes or unexpected process behavior. Check the official Microsoft advisory for the exact patched builds; no fixed version range is given in this data.