{"id":"CVE-2026-62897","state":"PUBLISHED","title":".NET Framework Remote Code Execution Vulnerability","description":"Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.","publishedAt":"2026-08-11T17:04:39.377Z","updatedAt":"2026-10-28T20:05:59.504Z","severity":{"score":7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft .NET 10.0 runtime","Microsoft .NET 8.0 runtime","Microsoft .NET 9.0 runtime","Microsoft Microsoft .NET Framework 3.5","Microsoft Microsoft .NET Framework 3.5 AND 4.7.2","Microsoft Microsoft .NET Framework 3.5 AND 4.8","Microsoft Microsoft .NET Framework 4.8.1","Microsoft Microsoft Visual Studio 2022 version 17.14","Microsoft Microsoft Visual Studio 2026 version 18.8"],"affected":[{"vendor":"Microsoft","product":".NET 10.0 runtime","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.11","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 8.0 runtime","versions":[{"version":"8.0.0","status":"affected","lessThan":"8.0.30","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 9.0 runtime","versions":[{"version":"9.0.0","status":"affected","lessThan":"9.0.19","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 3.5","versions":[{"version":"3.5.0","status":"affected","lessThan":"2.0.50727.9183 & 3.0.30729.9169","versionType":"custom"}],"platforms":["Windows 11 Version 26H1 for ARM64-based Systems","Windows 11 version 26H1 for x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 3.5 AND 4.7.2","versions":[{"version":"4.7.0","status":"affected","lessThan":"2.0.50727.9070 & 3.0.30729.9068 & 4.7.4144.0","versionType":"custom"}],"platforms":["Windows 10 Version 1809 for ARM64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 3.5 AND 4.8","versions":[{"version":"4.8.0","status":"affected","lessThan":"2.0.50727.9070 & 3.0.30729.9068 & 4.8.4805.0","versionType":"custom"}],"platforms":["Windows 10 Version 1809 for ARM64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 4.8.1","versions":[{"version":"4.8.0.0","status":"affected","lessThan":"4.8.9344.0","versionType":"custom"}],"platforms":["Windows 11 Version 26H1 for ARM64-based Systems","Windows 11 version 26H1 for x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.14","versions":[{"version":"17.14.0","status":"affected","lessThan":"17.14.38","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2026 version 18.8","versions":[{"version":"18.0","status":"affected","lessThan":"18.8.3","versionType":"custom"}]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62897"],"weaknesses":["CWE-190"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/62xxx/CVE-2026-62897.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-62897","state":"PUBLISHED","datePublished":"2026-08-11T17:04:39.377Z","dateUpdated":"2026-10-28T20:05:59.504Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2026-07-14T21:25:21.035Z"},"containers":{"cna":{"title":".NET Framework Remote Code Execution Vulnerability","descriptions":[{"lang":"en-US","value":"Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally."}],"affected":[{"vendor":"Microsoft","product":".NET 10.0 runtime","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.11","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 8.0 runtime","versions":[{"version":"8.0.0","status":"affected","lessThan":"8.0.30","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 9.0 runtime","versions":[{"version":"9.0.0","status":"affected","lessThan":"9.0.19","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 3.5","versions":[{"version":"3.5.0","status":"affected","lessThan":"2.0.50727.9183 & 3.0.30729.9169","versionType":"custom"}],"platforms":["Windows 11 Version 26H1 for ARM64-based Systems","Windows 11 version 26H1 for x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 3.5 AND 4.7.2","versions":[{"version":"4.7.0","status":"affected","lessThan":"2.0.50727.9070 & 3.0.30729.9068 & 4.7.4144.0","versionType":"custom"}],"platforms":["Windows 10 Version 1809 for ARM64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 3.5 AND 4.8","versions":[{"version":"4.8.0","status":"affected","lessThan":"2.0.50727.9070 & 3.0.30729.9068 & 4.8.4805.0","versionType":"custom"}],"platforms":["Windows 10 Version 1809 for ARM64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft .NET Framework 4.8.1","versions":[{"version":"4.8.0.0","status":"affected","lessThan":"4.8.9344.0","versionType":"custom"}],"platforms":["Windows 11 Version 26H1 for ARM64-based Systems","Windows 11 version 26H1 for x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.14","versions":[{"version":"17.14.0","status":"affected","lessThan":"17.14.38","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2026 version 18.8","versions":[{"version":"18.0","status":"affected","lessThan":"18.8.3","versionType":"custom"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62897","name":".NET Framework Remote Code Execution Vulnerability","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":7,"vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-190","description":"CWE-190: Integer Overflow or Wraparound","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2026-10-28T20:05:59.504Z"},"datePublic":"2026-08-11T14:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8.0.0","versionEndExcluding":"4.8.9344.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"3.5.0","versionEndExcluding":"2.0.50727.9183 & 3.0.30729.9169"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.11"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.0.30"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.19"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*","versionStartIncluding":"18.0","versionEndExcluding":"18.8.3"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.14.0","versionEndExcluding":"17.14.38"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8.0","versionEndExcluding":"2.0.50727.9070 & 3.0.30729.9068 & 4.8.4805.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7.0","versionEndExcluding":"2.0.50727.9070 & 3.0.30729.9068 & 4.7.4144.0"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-12T03:55:40.593167Z","id":"CVE-2026-62897","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-12T14:56:23.606Z"}}]}}}