Loading vulnerability…
Heap-Based Buffer Overflow Leading to Local Privilege Escalation in .NET
CVE-2026-32177 is a heap-based buffer overflow in .NET that allows an unauthorized local attacker to elevate privileges. Improper input validation permits out-of-bounds writes to a heap-allocated buffer in the runtime's native layer, potentially corrupting adjacent objects or heap metadata. Exploitation requires a user to trigger an attacker-controlled payload in an application. Affected products include .NET 8.0 before 8.0.27, 9.0 before 9.0.16, and 10.0 before 10.0.8, along with .NET Framework 3.5, 4.6.2, 4.7, 4.7.2, 4.8, and 4.8.1 without the applicable security updates. The specific vulnerable function has not been identified. Microsoft released fixes on May 12, 2026, and rated the vulnerability Important, with a CVSS 3.1 base score of 7.3.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can grant elevated local privileges, exposing sensitive information, including other users' credentials, and allowing modification of repository code or files on the target system. Heap corruption can also cause application crashes. The assessed confidentiality and integrity impacts are high, while availability impact is low. The vulnerability does not establish remote exploitation or a specific resulting privilege level.
If you can’t patch tonight, do this now.
Microsoft identifies no workaround or alternative mitigation for this vulnerability. Applying the official security updates is the supported remedy.
Patch, then assume compromise.
Install the latest supported Microsoft security updates for every affected .NET and .NET Framework installation. Minimum fixed modern runtime releases are .NET 8.0.27, 9.0.16, and 10.0.8. Apply the applicable .NET Framework cumulative security updates through Microsoft's update channels. For affected Visual Studio installations, update to at least 2017 version 15.9.80, 2019 version 16.11.56, 2022 version 17.12.20 or 17.14.31 on the corresponding servicing branch, or 2025 version 18.5.3. On Photon OS 5.0, apply advisory PHSA-2026-5.0-90-1027 using tdnf to update dotnet-runtime to 10.0.12-2.ph5 or a later vendor-fixed package.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.