CVE-2026-70354

The CVSS-EPSS gap on this CVE deserves scrutiny before you treat it as routine triage. A 7.8 CVSS paired with an EPSS of 0.00387 tells two different stories: CVSS measures worst-case impact assuming an attacker has already achieved access; EPSS measures the probability of automated mass-exploitation in the wild. These metrics are orthogonal, and this CVE is a textbook case of when they diverge productively. The 'local execution' qualifier in the CVSS vector is the operative factor. For a .NET out-of-bounds write, 'local' means the attacker needs a foothold on the target system already — through a separate initial access vector, social engineering, or a user executing malicious content. This fundamentally changes the threat model compared to network-reachable memory corruption. The CVSS is technically accurate, but it overstates urgency for defenders who read 'HIGH' and prioritize it above genuinely remote, wormable vulnerabilities in their queue. That said, don't dismiss this based on EPSS alone. Two factors should inform your triage decision. First, examine your attack surface topology: if you have ASP.NET applications running as SYSTEM, containerized .NET workloads with shared runtimes, or service accounts that have broad network access, a 'local' vulnerability becomes a lateral movement pivot. The blast radius depends on the privilege context of the hosting process, not the vulnerability's CVSS vector. Second, audit your forgotten .NET surface: legacy ASP.NET Framework 4.x apps, internal tools on deprecated runtimes, and third-party NuGet packages with unaudited transitive dependencies represent the real exposure. An EPSS of 0.00387 correctly reflects low probability of automated mass-scanning — but it says nothing about an attacker who reaches that forgotten runtime laterally from an already-compromised internal system. The gap itself is a signal. Organizations that systematically deprioritize .NET local vulns based on EPSS don't accumulate one unpatched 7.8 — they accumulate a backlog. Individual probability stays low; aggregate systemic exposure does not. Patch this CVE on your high-privilege .NET surfaces (ASP.NET servers, system services, shared runtime hosts) even if you deprioritize it on low-privilege user workstations. The decision should be topology-aware, not metric-driven.

Reviewed through automated stages and approved by a human before publication.