CVE-2026-35433: .NET Privilege Escalation Vulnerability

CVE-2026-35433 Overview

CVE-2026-35433 is an improper input validation vulnerability in Microsoft .NET that enables local privilege escalation. An unauthorized attacker with local access can exploit insufficient validation logic to elevate privileges on the affected host. The flaw is tracked under CWE-20: Improper Input Validation and requires user interaction to trigger the exploitation path. Successful exploitation impacts confidentiality and integrity of the system while producing a limited availability effect. Microsoft published mitigation guidance through the Microsoft Security Update Guide.

Critical Impact

Local attackers can elevate privileges on systems running vulnerable .NET components after convincing a user to perform a specific action.

Affected Products

• Microsoft .NET (versions identified in the Microsoft Security Update Guide)
• Applications built on the affected .NET runtime
• Systems with vulnerable .NET components installed

Discovery Timeline

• 2026-05-12 - CVE-2026-35433 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-35433

Vulnerability Analysis

The vulnerability stems from improper input validation within .NET code paths that process untrusted data during execution. When the runtime fails to enforce expected constraints on input, an attacker can craft data that drives the process into an unintended state. This state permits actions that should be restricted to higher-privileged contexts. The result is a privilege escalation primitive that operates entirely from a local session.

Exploitation requires user interaction, indicating that the attacker likely persuades a logged-in user to open a file, run an application, or interact with a malicious artifact. The scope remains unchanged, so the privilege gain occurs within the same security boundary as the targeted process. Confidentiality and integrity impact are high because the attacker can read and modify protected resources after escalation.

Root Cause

The root cause is classified as [CWE-20: Improper Input Validation]. The .NET component accepts input without sufficiently verifying its structure, length, or type before using it in security-sensitive operations. Microsoft has not disclosed the precise function or code path involved in the public advisory.

Attack Vector

The attack vector is local with low attack complexity and no privileges required. An attacker delivers crafted input that a victim processes through a vulnerable .NET application or runtime component. After the input is processed, the attacker gains elevated privileges on the host. Technical details are available in the Microsoft Security Update Guide.

Detection Methods for CVE-2026-35433

Indicators of Compromise

• Unexpected child processes spawned by .NET applications running under user accounts
• Token manipulation or process integrity changes following the execution of recently delivered files
• Anomalous file writes to protected directories by .NET runtime processes

Detection Strategies

• Monitor for .NET processes loading unsigned or unexpected assemblies from user-writable paths
• Correlate user interaction events such as file open or application launch with subsequent privilege changes
• Apply behavioral analytics that flag privilege escalation patterns originating from interactive sessions

Monitoring Recommendations

• Enable Windows process creation auditing with command line logging via Event ID 4688
• Forward .NET runtime telemetry and Sysmon events to a centralized analytics platform
• Track installation state of .NET runtimes across the fleet to identify unpatched hosts

How to Mitigate CVE-2026-35433

Immediate Actions Required

• Apply Microsoft security updates for affected .NET versions referenced in the Microsoft Security Update Guide
• Inventory hosts and applications that ship or depend on vulnerable .NET runtimes
• Restrict execution of untrusted .NET applications through application control policies

Patch Information

Microsoft has issued a security update for CVE-2026-35433. Administrators should consult the Microsoft Security Update Guide for the exact runtime and SDK versions that resolve this issue and deploy updates through Windows Update, WSUS, or the .NET installer channels.

Workarounds

• Limit local user permissions and enforce least privilege to reduce the value of escalation
• Use application allowlisting to block execution of untrusted binaries that target the vulnerable runtime
• Educate users to avoid opening unsolicited files that may trigger the vulnerable code path

# Verify installed .NET runtime versions on Windows
dotnet --list-runtimes
dotnet --list-sdks