This vulnerability (CVE-2026-45490) affects Microsoft .NET 10.0 on Windows systems. It arises from insufficient access controls on a named pipe used by the dotnet.exe workload command in the .NET SDK. A local attacker with authorized access can exploit this flaw to perform arbitrary file creation or truncation operations with the privileges of another local user, leading to privilege escalation and unauthorized data access or modification. The issue is tracked under CWE-285 (Improper Authorization) and CWE-266 (Incorrect Privilege Assignment). Microsoft has released an official fix for this vulnerability.

The vulnerability allows a local attacker with some level of authorization to escalate privileges by exploiting access control weaknesses on a named pipe. This can result in unauthorized creation or truncation of files with another user's privileges, leading to potential unauthorized access, modification, or destruction of sensitive data. The CVSS v3.1 base score is 7.8 (high severity), reflecting high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft and should be applied to affected systems running .NET 10.0 on Windows. The vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45490 provides details on patch availability. Red Hat products are not affected by this vulnerability. No additional mitigations are specified beyond applying the official patch.