Deserialization Vulnerability in .NET Framework by Microsoft
CVE-2026-50649

7.8HIGH

Key Information:

Vendor

Microsoft
Status
.net 8.0
.net 9.0
Microsoft Visual Studio 2022 Version 17.12
Microsoft Visual Studio 2022 Version 17.14
Vendor
CVE Published:
14 July 2026

What is CVE-2026-50649?

A vulnerability in the .NET Framework allows an unauthorized attacker to remotely execute arbitrary code through deserialization of untrusted data. This flaw can potentially compromise system security if exploited, making it crucial for users to apply necessary patches and updates to mitigate the risk.

Affected Version(s)

.NET 8.0 8.0.0 < 8.0.29

.NET 9.0 9.0.0 < 9.0.18

Microsoft Visual Studio 2022 version 17.12 17.12.0 < 17.12.22

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.