Brief Summary: CVE-2026-35433 — .NET Elevation of Privilege via Improper Input Validation and Integer Overflow

Introduction

An improper input validation flaw in the .NET runtime, combined with an integer overflow condition, gives a local attacker a path to SYSTEM-level privileges on affected Windows systems. Microsoft patched CVE-2026-35433 on May 12, 2026, in a Patch Tuesday cycle that addressed 120 security flaws. No exploitation has been observed in the wild. Still, the CVSS 7.3 score and the potential for full privilege escalation make this one worth tracking for any organization running modern .NET workloads.

Technical information

CVE-2026-35433 is classified under two CWE categories: CWE-20 (Improper Input Validation) and CWE-190 (Integer Overflow or Wraparound). The .NET runtime receives input but incorrectly validates whether it has the required properties to process data safely. The advisory description focuses on input validation, but the CWE-190 tag strongly suggests that the vulnerable code path involves integer arithmetic operations that can be manipulated to produce unexpected values and, in the end, bypass privilege boundaries.

Attack vector and prerequisites

The attack vector is local. An attacker must already have read, write, or execute capabilities on the target system. The attack complexity is low, so no specialized access conditions or race conditions are required. Exploitation does require user interaction, though: a legitimate user must be tricked into triggering the malicious payload within the affected application.

Impact

A successful attacker can elevate privileges to SYSTEM level. Microsoft rates the confidentiality and integrity impact as high, which means the attacker can view sensitive information and modify code within repositories. Availability impact is rated low.

What we know (and don't know)

The available vendor advisories do not say which subcomponent of the .NET runtime is vulnerable. No public proof-of-concept code or detailed exploit writeups are available. Based on the CWE-190 classification, the patch likely adds bounds or arithmetic checks to integer operations that could previously be manipulated during input processing. The pairing of an input validation failure with an integer overflow suggests a scenario where attacker-controlled input flows into an arithmetic operation (such as a size or offset calculation) without proper range checking. In that scenario, the resulting overflow leads to a security boundary violation.

Patch information

Microsoft fixed CVE-2026-35433 in the May 12, 2026 Patch Tuesday servicing cycle. The fix shipped simultaneously across all three currently supported .NET release lines.

This CVE applies only to .NET (Core) 8.0, 9.0, and 10.0. It does not affect .NET Framework (3.5, 4.x), unlike some of the other CVEs released the same day (e.g., CVE-2026-32177), which also touched .NET Framework. Organizations running mixed environments only need to update the modern .NET runtimes for this specific vulnerability.

The .NET 10.0.8 release notes on GitHub list CVE-2026-35433 under "Notable Changes" as a ".NET Elevation of Privilege Vulnerability" and state that the fix addresses improper input validation. The .NET 9.0.16 release notes carry the same advisory text, which confirms the backport across all affected branches.

Microsoft's official servicing blog post from May 12, 2026, by Rahul Bhandari and Tara Overfield, lists CVE-2026-35433 alongside CVE-2026-32177, CVE-2026-32175, and CVE-2026-42899 as the security fixes in this monthly cycle.

Deployment guidance

To apply the fix, developers and administrators should update to the patched runtime versions and verify with dotnet --version. For containerized workloads, updated Docker images are available on mcr.microsoft.com. Self-contained applications embed the .NET runtime in their output directory, so they need to be republished against the fixed SDK to pick up the patch.

Administrators should patch developer workstations, build servers, and application servers where code integrity is critical first.

Affected systems and versions

The following .NET runtime versions are affected:

• .NET 10.0: All versions prior to 10.0.8
• .NET 9.0: All versions prior to 9.0.16
• .NET 8.0: All versions prior to 8.0.27

.NET Framework 3.5 and 4.x are not affected by this specific CVE.

The vulnerability applies to .NET runtimes running on Windows. The attack vector is local, so only systems where an attacker already has some level of access are at risk.

Vendor security history

The May 2026 Patch Tuesday cycle addressed 120 security flaws across Microsoft's product portfolio, with zero actively exploited vulnerabilities at the time of release. In the .NET servicing updates, CVE-2026-35433 shipped alongside CVE-2026-32177, CVE-2026-32175, and CVE-2026-42899, so this cycle fixed several security issues in the .NET runtime. Microsoft coordinates its security patches through the Microsoft Security Response Center (MSRC), which provides exploitability assessments, detailed advisories, and automated API access for security updates.

References

• CVE-2026-35433: MSRC Security Update Guide
• CVE-2026-35433: NVD Detail Page
• .NET and .NET Framework May 2026 Servicing Releases Updates (.NET Blog)
• .NET 10.0.8 Release Notes (GitHub)
• .NET 9.0.16 Release Notes (GitHub)
• CVE-2026-35433 on VulDB
• Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days (BleepingComputer)
• The May 2026 Security Update Review (Zero Day Initiative)
• KB5087048: Security and Quality Rollup for .NET Framework 3.5 for Windows Server 2012
• KB5087067: Security and Quality Rollup for .NET Framework 4.8 for Windows Server 2012