Brief Summary: CVE-2026-32177 — Heap Buffer Overflow in .NET Enables Local Privilege Escalation

Introduction

A heap-based buffer overflow in the .NET runtime, patched in Microsoft's May 2026 Patch Tuesday, lets a local attacker with no prior privileges escalate their access on a target system. It has a CVSS 3.1 score of 7.3 and reaches .NET 8 through 10, legacy .NET Framework installations, and several Visual Studio versions, so it touches a significant portion of Windows developer and server environments.

Microsoft has confirmed that no workarounds or mitigations are available. The only remediation is to apply the official patches. The good news is that there is currently no evidence of active exploitation, and exploit code maturity is classified as Unproven.

Technical Information

Root Cause

CVE-2026-32177 comes from two related weaknesses in the native layer of the .NET runtime:

1. Improper Input Validation (CWE-20): The runtime does not properly validate certain input before processing it, so specially crafted data can reach internal memory-management routines without adequate bounds checking.
2. Heap-Based Buffer Overflow (CWE-122): Because of the missing validation, an attacker can cause data to be written beyond the boundaries of a heap-allocated buffer. The overflow corrupts adjacent heap metadata or objects, and an attacker can use that corruption to gain elevated privileges.

The native layer where heap management happens is closed source, so there is no public source code diff for the fix. The CWE mappings still make the nature of the patch clear. The update introduces stricter input validation to stop the heap-based buffer overflow from being triggered in the first place.

Attack Vector and Exploitation Flow

The CVSS vector string is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L. Its metrics describe how exploitation works:

1. Local access required (AV:L): The vulnerable component is not exposed over the network. The attacker needs local access to the target system, either at the physical console or through a remote session over SSH or RDP.

2. No privileges required (PR:N): The attacker does not need an existing account or any prior authorization on the system to trigger the vulnerability.

3. User interaction required (UI:R): A legitimate user has to perform an action first, such as opening a malicious document, running a crafted application, or otherwise triggering the vulnerable code path in the .NET runtime.

4. Low attack complexity (AC:L): No specialized conditions or race windows are needed. Once the attacker can deliver the malicious input and a user interacts with it, exploitation is repeatable and reliable.

Impact

Successful exploitation results in:

• High confidentiality impact: The attacker can view sensitive information, including the credentials of other users on the system.
• High integrity impact: The attacker can modify file contents on the target server without authorization.
• Low availability impact: The application may crash, but system-wide denial of service is not the primary outcome.

The scope is unchanged (S:U), so the impact stays within the vulnerable component's security authority and does not cascade into other components.

Patch Information

Microsoft released official patches for CVE-2026-32177 on May 12, 2026, as part of its regular Patch Tuesday cycle. With no workarounds available, these updates are the only remediation path.

Modern .NET Runtime

For modern .NET, Microsoft shipped updated runtimes that correct the buffer overflow:

Developers who get .NET through NuGet or the SDK can update to the matching SDK versions, for example SDK 9.0.314 or 9.0.117 for .NET 9.0, and SDK 8.0.421 or 8.0.127 for .NET 8.0. Updated Docker container images for all three branches are also available on mcr.microsoft.com.

Legacy .NET Framework

The vulnerability affects .NET Framework versions 3.5, 4.6.2, 4.7, 4.7.2, 4.8, and 4.8.1. The fixed builds are 4.8.9334.0 and 4.8.4802.0, depending on the framework branch. Microsoft delivers them through cumulative updates, including:

Visual Studio

Visual Studio bundles the .NET runtime, so it received coordinated patches as well:

Deployment Channels

All patches are available through Windows Update and Windows Update for Business. Standalone packages are on the Microsoft Update Catalog. Enterprise administrators can deploy them through WSUS by targeting the appropriate product classifications. For .NET (non-Framework) applications, developers should update with the dotnet-install scripts or by targeting the fixed SDK or runtime version in their project configurations.

Affected Systems and Versions

The affected products and versions are:

Modern .NET (versions prior to the fix):

• .NET 10.0 (versions before 10.0.8)
• .NET 9.0 (versions before 9.0.16)
• .NET 8.0 (versions before 8.0.27)

Legacy .NET Framework:

• .NET Framework 3.5
• .NET Framework 4.6.2
• .NET Framework 4.7
• .NET Framework 4.7.2
• .NET Framework 4.8 (versions before build 4.8.4802.0)
• .NET Framework 4.8.1 (versions before build 4.8.9334.0)

These .NET Framework versions are affected on both Windows Server and Windows client operating systems, including Windows 10 Version 21H2, Windows 10 Version 22H2, and Windows Server 2022.

Visual Studio:

• Visual Studio 2017 (15.9.x, versions before 15.9.80)
• Visual Studio 2019 (16.11.x, versions before 16.11.56)
• Visual Studio 2022 (17.12.x, versions before 17.12.20)
• Visual Studio 2022 (17.14.x, versions before 17.14.31)
• Visual Studio 2025 (18.5.x, versions before 18.5.3)

Vendor Security History

Microsoft runs a mature, highly structured security response program through the Microsoft Security Response Center (MSRC). MSRC investigates vulnerabilities, coordinates disclosures, and releases security updates on the second Tuesday of each month. Microsoft also works with external security researchers through bug bounty programs that have awarded more than $60 million since 2013. The May 2026 Patch Tuesday cycle that fixed this vulnerability covered 120 vulnerabilities in total, and no zero days were reported as exploited in the wild.

References

• Microsoft Security Update Guide: CVE-2026-32177
• NVD Entry for CVE-2026-32177
• CVE.org Record for CVE-2026-32177
• .NET and .NET Framework May 2026 Servicing Updates
• KB5088863: .NET Framework Update for Windows 10 22H2
• KB5088862: .NET Framework Update for Windows Server 2022
• .NET 9.0.16 Release Notes
• .NET 8.0.27 Release Notes
• BleepingComputer: Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days
• BleepingComputer: Microsoft Patch Tuesday May 2026 Report
• CybersecurityNews: Microsoft Patch Tuesday May 2026
• Microsoft Security Blog: How MSRC Coordinates Vulnerability Research and Disclosure