CVE-2026-85363

Executive Summary

CVE-2026-85363 is an integer overflow or wraparound vulnerability (CWE-190) in .NET Framework that allows an unauthorized, network-positioned attacker to elevate privileges. Exploitation requires user interaction (UI:R), indicating a victim must perform an action — such as opening a crafted file or visiting a malicious resource — before the flaw can be triggered.

The CVSS v3.1 base score is 8.8 (High), reflecting network attack vector, low attack complexity, no required privileges, and high impact to confidentiality, integrity, and availability. No public proof-of-concept, exploit code, or Nuclei template exists, and the vulnerability is not listed in CISA KEV. A patch is claimed by a single source (GHSA), but the fix is not independently verified and no patch version has been disclosed.

Technical Analysis

CVE-2026-85363 is classified as CWE-190: Integer Overflow or Wraparound. This weakness class occurs when an arithmetic operation produces a numeric value that exceeds the maximum (or falls below the minimum) representable range of the integer type used to store it. In managed runtimes such as .NET Framework, such conditions typically arise in one of a small number of contexts: size or length calculations used for buffer allocation, array index or offset computations, or loop counters and bounds derived from attacker-influenced input.

The NVD description is deliberately sparse. It states only that the integer overflow "allows an unauthorized attacker to elevate privileges over a network." No affected component, namespace, class, method, file path, or API surface is named. Consequently, the following analysis is bounded by what the classification and CVSS vector permit — it does not assert specific internal implementation details.

Mechanism at the vulnerability-class level: When an attacker supplies input whose size or value feeds into an arithmetic operation, an overflow can cause a computed value to wrap to an unexpected — typically much smaller — result. Where that computed value is subsequently used for memory sizing, bounds checking, or an access-control decision, the mismatch between the attacker's intended size and the wrapped value can allow data to be written or read beyond intended limits, or can cause a security-relevant branch to evaluate incorrectly. In the privilege-escalation context described, this class of flaw typically enables corruption or bypass that increases the attacker's effective privilege level within the affected process or runtime.

Attack surface: The CVSS vector specifies AV:N (network) and UI:R (user interaction). This combination indicates the vulnerable code path is reachable through network-delivered content but requires the victim to take an action — for example, processing a crafted input through an application built on the affected .NET Framework. The PR:N (no privileges) rating confirms the attacker does not need an existing account or foothold, while AC:L (low complexity) suggests no specialized conditions or race windows are required to trigger the flaw.

The absence of a CNA title, affected version list, OSV package data, and vendor fix information means the precise code path and the specific .NET Framework versions or components in scope cannot be established from the available data. No public PoC exists, so the attack chain below is inferred from the vulnerability class and CVSS vector rather than from observed exploit tooling.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-85363. The attack chain below is inferred strictly from the CWE-190 classification and the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No specific function names, class names, endpoints, or parameters are asserted, because none are present in the source description or CNA title.

1) Reconnaissance / target identification. An attacker identifies a target application or service that is built on .NET Framework and that accepts network-delivered input which is later processed by the vulnerable code path. Because the vector is network-based with required user interaction, realistic targets are applications where a remote user can supply content that the framework-side logic then handles — for instance, a service or application that parses a structured input (document, message, or request payload) and performs size- or length-dependent computation on it. No specific target product is named in the source data, so identification depends on environment-specific knowledge of which .NET Framework applications are exposed and reachable by attacker-influenced input.

2) Triggering the flaw class. The attacker crafts input in which a size, length, count, or offset value is selected so that an arithmetic operation performed by the affected code overflows or wraps. The crafted value is delivered over the network to the target, and the victim is induced to process it — satisfying the UI:R requirement. Because the flaw class is integer overflow, the malicious input is characterized at the class level by numeric values at or near the boundary of the relevant integer type, rather than by any specific payload signature. No specific parameter name or input field can be cited from the available data.

3) Execution / consequence of the overflow. The wrapped arithmetic result is then used by the affected logic in a way that produces a security-relevant effect — for example, a bounds or size check that no longer matches the true size of the data, or a decision that evaluates incorrectly. At the vulnerability-class level, this is the point at which the integer overflow converts into a privilege-escalation primitive. The precise primitive (memory corruption leading to code execution within the process, or a logic/authorization bypass) is not determinable from the available description; the CVSS scope of S:U (unchanged) indicates the impact remains within the affected security authority, while C:H/I:H/A:H indicates high impact across confidentiality, integrity, and availability.

4) Post-exploitation impact. Successful exploitation yields elevated privileges for the attacker. Given the high CIA impact ratings, the outcome can include unauthorized access to sensitive data, modification of data or configuration, and disruption of availability within the affected component's context. The S:U rating constrains the impact to the vulnerable component's security authority rather than crossing to a separate authority.

Impact Assessment

CVE-2026-85363 carries a CVSS v3.1 base score of 8.8 (High). The subscores decompose as follows:

• AV:N (Network) — the flaw is exploitable from a network position, expanding the pool of potential attackers beyond those with local access.
• AC:L (Low) — no special conditions, races, or timing constraints are required, lowering the skill barrier for exploitation.
• PR:N (None) — the attacker requires no prior credentials or privileges, meaning unauthenticated external actors are in scope.
• UI:R (Required) — a victim must perform an action for exploitation to succeed. This is the single factor tempering the score and provides a meaningful detection and user-awareness mitigation lever.
• S:U (Unchanged) — impact is confined to the vulnerable component's security authority.
• C:H / I:H / A:H — high impact to confidentiality, integrity, and availability, indicating that successful exploitation can compromise data, alter state, and disrupt functionality.

Business impact: Because the flaw enables privilege elevation, a successful attack can allow an otherwise unprivileged actor to operate at a higher level of trust within the affected environment. Enterprises running .NET Framework-dependent applications — particularly internet-facing or line-of-business applications that process externally supplied input — are the primary exposure group. The requirement for user interaction means phishing, social engineering, or a web-based lure is a plausible delivery channel, which broadens the blast radius to include end-user workstations in addition to servers.

Blast radius considerations are difficult to bound precisely: no affected version list, no CPE data, and no OSV package mapping are provided in the source intelligence. Organizations should assume any .NET Framework deployment whose application surface matches the AV:N/UI:R profile may be in scope until vendor version guidance is available. EPSS has not yet scored this CVE, and it is not listed in CISA KEV, indicating no confirmed exploitation in the wild at the time of writing.

Detection Guidance

Detection strategy must account for the fact that no PoC or exploit signature exists. The rules below therefore target the vulnerable-code-path behavior at the vulnerability class level (unusual arithmetic-driven input, crash patterns, privilege transitions) rather than a known payload.

Sigma Rule

title: Potential Integer Overflow Exploitation Attempt in .NET Framework Applications
id: 3f9a2c71-8b4d-4e6a-9c2f-1d7a5e0b6c34
status: experimental
description: Detects process or application behavior consistent with exploitation of an integer overflow (CWE-190) in .NET Framework applications, including abnormal process privilege transitions following network-delivered input processing.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85363
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026-85363
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\w3wp.exe'
      - '\powershell.exe'
      - '\dotnet.exe'
  selection_integrity:
    IntegrityLevel:
      - 'High'
      - 'System'
  filter_known:
    ParentImage|endswith:
      - '\services.exe'
      - '\svchost.exe'
  condition: selection_image and selection_integrity and not filter_known
falsepositives:
  - Legitimate .NET application deployments and administrative maintenance windows
level: medium

YARA Rule

rule CVE_2026_85363_IntegerOverflow_NetFramework
{
    meta:
        description = "Heuristic detection for integer-overflow exploitation artifacts targeting .NET Framework (CVE-2026-85363, CWE-190)"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85363"
        tlp = "WHITE"

    strings:
        $mz = { 4D 5A }
        $net1 = "mscorlib" ascii wide
        $net2 = "System.Runtime" ascii wide
        $net3 = ".NET Framework" ascii wide
        $overflow_artifact = { 00 00 00 80 FF FF FF 7F }

    condition:
        $mz at 0 and
        (2 of ($net*)) and
        $overflow_artifact
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET any (msg:"CVE-2026-85363 Possible .NET Framework Integer Overflow Exploitation Attempt"; flow:established,to_server; content:"|7F FF FF FF|"; depth:512; threshold: type both, track by_src, count 5, seconds 60; classtype:attempted-user; reference:cve,2026-85363; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85363; sid:202685363; rev:1;)

Note: This signature targets repeated boundary-value (0x7FFFFFFF) patterns typical of integer-overflow probing. It is a heuristic and will require tuning against the specific affected application's protocol; no protocol-specific byte pattern is derivable from the available CVE description.

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [process where event.type == "start" and process.name : ("w3wp.exe", "dotnet.exe", "powershell.exe")]
  [process where event.type == "change" and process.parent.name : ("w3wp.exe", "dotnet.exe") and process.integrity_level in ("high", "system")]

Note: The Elastic rule correlates a .NET worker process start with a subsequent privilege-context transition on that process tree. It is behavioral and may generate false positives in environments with legitimate elevation tooling; tune allowlists accordingly.

Splunk SPL Query

index=windows (EventCode=4688 OR EventCode=4672)
| eval proc=lower(New_Process_Name)
| where like(proc, "%\\w3wp.exe") OR like(proc, "%\\dotnet.exe") OR like(proc, "%\\powershell.exe")
| join type=inner Subject_Logon_ID
    [ search index=windows EventCode=4672
      | rename Subject_Logon_ID as Subject_Logon_ID ]
| stats count values(New_Process_Name) as processes by ComputerName, Subject_Account_Name
| where count > 0
| table ComputerName, Subject_Account_Name, processes, count

Note: This query hunts for special-privilege assignment (4672) correlated with .NET worker process creation (4688), a behavioral proxy for privilege escalation. Adjust index and field names to match the local Splunk Windows add-on schema.

Wazuh OSSEC Rule

<group name="windows,cve-2026-85363,">
  <rule id="100853" level="10">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.newProcessName">\.(w3wp|dotnet|powershell)\.exe$</field>
    <field name="win.eventdata.integrityLevel">^(High|System)$</field>
    <description>CVE-2026-85363: Possible .NET Framework integer overflow privilege escalation - elevated process after network-facing process activity</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Note: Rule IDs in the 100000+ range are reserved for local/custom rules. Verify the parent rule ID (60000) and field names against the deployed Wazuh Windows Sysmon/EventChannel decoder before production use.

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). A GHSA reference is the only patch source provided; no patch version, KB number, or release identifier is available, and no vendor advisory was supplied. Treat the patch status as unverified.

1) Immediate mitigations:

• Because exploitation requires user interaction (UI:R), reinforce user awareness and email/web-browsing controls to reduce the likelihood that a crafted input reaches a vulnerable application. Block or carefully vet inbound content that will be processed by .NET Framework applications.
• Reduce the exposed attack surface: restrict network reachability to .NET Framework applications that process externally supplied input, applying network segmentation and least-exposure principles.
• Monitor application and web server logs for abnormal crash patterns, out-of-memory conditions, or unexpected privilege transitions following input processing, using the detection content in the preceding section.
• Maintain current backups and ensure integrity monitoring for .NET Framework application directories, since the CVE carries high integrity impact.

2) Patch / upgrade steps:

• Track the GHSA advisory and the Microsoft .NET Framework security update channel for a confirmed patch. Apply vendor security updates as soon as a specific patched version is published and verified.
• Since the affected version range is not enumerated in the source data, inventory all .NET Framework installations and applications across the estate, and map them to the vendor's published affected-version guidance once available.
• Validate the patch in a staging environment before broad deployment, confirming that the affected application still functions correctly post-update.
• Do not rely on the unconfirmed single-source patch claim; wait for independent confirmation and vendor version guidance before declaring closure.

3) Long-term hardening:

• Establish a routine .NET Framework patch cadence and inventory discipline so future framework-level CVEs can be triaged against a known asset map quickly.
• Adopt secure-coding review practices focused on CWE-190 integer overflow, particularly for developers building on the affected framework: validate size and length arithmetic, use checked arithmetic where appropriate, and enforce strict bounds checking on all externally supplied values.
• Apply application-layer input validation and size limits to reduce the range of values that reach arithmetic-heavy code paths.
• Maintain detection coverage for privilege-escalation behavior (T1068) independent of any single CVE, so behavioral detections remain effective as specific exploit signatures evolve.

References

1. NVD — CVE-2026-85363: https://nvd.nist.gov/vuln/detail/CVE-2026-85363
2. CWE-190: Integer Overflow or Wraparound — https://cwe.mitre.org/data/definitions/190.html
3. MITRE ATT&CK T1068 — Exploitation for Privilege Escalation — https://attack.mitre.org/techniques/T1068/
4. GitHub Security Advisories (GHSA) — cited as the single source claiming a patch; specific advisory identifier not provided in source data — https://github.com/advisories
5. FIRST EPSS — CVE-2026-85363 (not yet scored) — https://www.first.org/epss/

Threat actor and exploitation status: No public PoC, exploit code, or Nuclei template exists for CVE-2026-85363. The CVE is not listed in CISA KEV, and no exploit-in-the-wild evidence or attributed threat actor campaign is present in the available source data. EPSS has not yet assigned a score. The vulnerability should be treated as a high-severity (8.8), unconfirmed-patch issue warranting inventory and monitoring while vendor version and patch details are awaited.