Jul 2026: .NET Remote Code Execution Vulnerability
CVE-2026-50649 Published on July 14, 2026

.NET Remote Code Execution Vulnerability
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Vendor Advisory NVD

Weakness Type

What is a Marshaling, Unmarshaling Vulnerability?

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

CVE-2026-50649 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.

Products Associated with CVE-2026-50649

Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.

Microsoft Visual Studio 2022

Microsoft Net

Microsoft Visual Studio 2026

Microsoft .NET Framework

Affected Versions

Microsoft .NET 8.0:

Version 8.0.0 and below 8.0.29 is affected.

Microsoft .NET 9.0:

Version 9.0.0 and below 9.0.18 is affected.

Microsoft .NET Framework 3.5:

Version 3.5.0 and below 2.0.50727.9182 & 3.0.30729.9168 is affected.

Microsoft .NET Framework 3.5 AND 4.7.2:

Version 4.7.0 and below 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0 is affected.

Microsoft .NET Framework 3.5 AND 4.8:

Version 4.8.0 and below 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 is affected.

Microsoft .NET Framework 3.5 AND 4.8.1:

Version 4.8.1 and below 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 is affected.

Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2:

Version 4.7.0 and below 4.7.4143.0 is affected.

Microsoft .NET Framework 4.8:

Version 4.8.0 and below 4.8.4803.0 is affected.

Microsoft .NET Framework 4.8.1:

Version 4.8.0.0 and below 4.8.9340.0 is affected.

Microsoft Visual Studio 2026 version 18.7:

Version 18.0 and below 18.7.4 is affected.

Exploit Probability

EPSS

0.92%

Percentile

56.57%