CVE-2026-62909

This is a .NET bug that can turn “limited access” into “full control” of a computer. Think of it like a locked back door that becomes usable after a specific kind of error happens—an attacker who already has a foothold locally can jump to the highest privileges. If this is on your developer machines or any system running these .NET/Visual Studio versions, it raises the risk of data theft, malware installation, and disruption.

This matters if you use .NET 8.0, .NET 9.0, .NET 10.0, or Visual Studio 2022 version 17.14, or Visual Studio 2026 version 18.8. It’s a local-only issue, so it requires an attacker to already have local access at low privileges. The risk is real when the affected software is installed on machines that could be reached by an attacker (for example, a workstation where accounts can be compromised), since it’s reachable in default configurations.

This is RED because attackers with low-level local access can use the flaw to escalate privileges and fully compromise the affected machine. Even without a known public exploit, this kind of local privilege escalation is a direct path from “someone got in” to “total control,” and it’s reachable in default configurations. Prioritize patching immediately on any systems running the affected .NET/Visual Studio versions.