CVE-2026-62897

.NET Framework is the software platform many Windows apps rely on. This vulnerability is like a math mistake in that platform: if someone can get a user to open a specially crafted file, it may let an attacker run malicious code on the machine. That code could then work with the same high permissions the user has, which can lead to serious damage.

This matters if you run Windows software that uses the listed .NET Framework/.NET/.NET versions or you have Visual Studio 2022 or Visual Studio 2026 installed on your business computers. The weakness requires an attacker to have local access and to trick a user into interacting with a malicious file, so it’s not a “drive-by internet” risk by itself.

Risk is primarily if an attacker can reach a user locally (for example, through an already-compromised device or a close-by scenario) and then get that user to open a malicious file using the vulnerable .NET/.NET Framework component.

This is urgent (RED) because the vulnerability can be used to execute code locally with high privileges after user interaction, and there is security reporting naming the Lazarus group as an actor relevant to this patch cycle. Even though there’s no clear dated public claim of exploitation in the news findings and no public exploit code was found, you should treat this as an active, high-value target for attackers.

Update immediately across all machines that run the vulnerable .NET/.NET Framework and Visual Studio versions listed in the fix guidance.

Confirm what you’re running

1. Inventory endpoints: list every machine that has any of the following installed: .NET (including .NET 8.0 and .NET 9.0), .NET 10.0, Microsoft .NET Framework 3.5, Microsoft .NET Framework 4.x variants (including 4.7.2, 4.8, and 4.8.1), and Visual Studio 2022 / Visual Studio 2026.
2. For each machine, capture the exact installed versions of:
   • Visual Studio 2022
   • Visual Studio 2026
   • .NET (8.0 and/or “.NET 8.0”)
   • .NET 9.0
   • .NET 10.0
   • .NET Framework 3.5 and its combined runtime sets (where applicable)
   • .NET Framework 4.8.1

Patch to the fixed versions

Apply the Microsoft update guidance for CVE-2026-62897 and update each component to the fixed versions:

• Visual Studio 2022 → fixed in 17.14.38
• Visual Studio 2026 → fixed in 18.8.3
• .NET → fixed in 8.0.30
• .NET 8.0 → fixed in 8.0.30
• .NET 9.0 → fixed in 9.0.19
• .NET 10.0 → fixed in 10.0.11
• Microsoft .NET Framework 3.5 → fixed in 2.0.50727.9183 & 3.0.30729.9169
• Microsoft .NET Framework 3.5 AND 4.7.2 → fixed in 2.0.50727.9070, 3.0.30729.9068, & 4.7.4144.0
• Microsoft .NET Framework 3.5 AND 4.8 → fixed in 2.0.50727.9070, 3.0.30729.9068, & 4.8.4805.0
• Microsoft .NET Framework 4.8.1 → fixed in 4.8.9344.0

If patching is delayed (temporary containment)

• Reduce exposure to malicious files: ensure users can’t easily open unknown attachments/files (especially “double-click to run” style content).
• Prioritize patching on any machine that is more exposed to local attacker scenarios (shared kiosks, machines used by many people, or devices with a history of suspicious activity).

After patching

1. Re-check versions and confirm every targeted component is now at (or above) the listed fixed versions.
2. Monitor for unusual behavior on patched endpoints (unexpected crashes, repeated attempts to open unknown files, or new suspicious processes). The findings don’t list specific detection rules, so focus on general “new executable launched from user-opened content” patterns.

Timeline note

• KEV (CISA Known Exploited Vulnerabilities) is not listed in the findings, and no clear dated exploitation claim appears in the news findings; still, the RED urgency is driven by the high-privilege local code execution potential and the actor mention (Lazarus group) in the patch-related reporting.

CVE-2026-62897 is a .NET Framework local code execution vulnerability stemming from an integer overflow/wraparound (CWE-190) during number calculations. The practical trigger in the findings is local attacker presence plus tricking a user into opening a specially crafted file; there is no authentication required, but it is not a pure remote drive-by scenario.

Exposure characteristics from the findings: local attack vector, no authentication, user interaction required, and outcome is arbitrary code execution on the system with high privileges. KEV is not listed, there is no public exploit code on record, and press findings do not show clear dated exploitation claims.

PULSE indicates “actor: Lazarus group” in connection with this patch cycle, which increases real-world concern even though the findings don’t provide confirmed KEV exploitation. EPSS is provided as a prediction in the findings, but public blocks should not rely on that figure when higher-priority exploitation/actor signals exist.

Fix availability is concrete via Microsoft update guidance: Visual Studio 2022/2026 and multiple .NET/.NET Framework branches have specific fixed versions listed in the patch findings.