Unchecked Return Value in Microsoft products - CVE-2026-62909
Published: August 12, 2026
Vulnerability identifier: #VU141795
CSH Severity: Low
CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-62909
CWE-ID: CWE-252
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to elevate privileges.
The vulnerability exists due to unchecked return value in .NET when handling exceptional conditions. A local user can trigger an uncaught exception to elevate privileges.
Successful exploitation requires the target system to be set up in a specific manner and the attacker to have knowledge of that setup.
Affected software
.NET
Visual Studio
.NET for Linux
.NET for macOS
Microsoft .NET Framework
Visual Studio
.NET for Linux
.NET for macOS
Microsoft .NET Framework
How to mitigate CVE-2026-62909
Install security update from vendor's website.
.NET - addressed in versions 8.0.30, 9.0.19
Visual Studio - update to 17.14.38
.NET for Linux - addressed in versions 8.0.30, 9.0.19
.NET for macOS - addressed in versions 8.0.30, 9.0.19
Microsoft .NET Framework - update to 10.0.11
Visual Studio - update to 17.14.38
.NET for Linux - addressed in versions 8.0.30, 9.0.19
.NET for macOS - addressed in versions 8.0.30, 9.0.19
Microsoft .NET Framework - update to 10.0.11