CVE-2026-62909

This CVE represents a logic flaw in exception handling that bypasses .NET's managed security model — not a memory corruption issue — which means traditional exploit mitigations (ASLR, stack canaries) provide zero protection. The vulnerability stems from .NET's async patterns creating a systematic trap: when developers write `DoSomethingAsync()` instead of `await DoSomethingAsync()`, exceptions are silently captured into the Task and never surface to the caller. The caller sees 'started successfully' as equivalent to 'completed successfully' — a conflation the type system does not warn against. In authorization paths, this means security checks that should gate on completion instead gate on initiation, leaving the privilege context in an ambiguous or partially-applied state when the exception fires mid-elevation. Downstream components (distributed caches, database connections, inter-service tokens) receive what appears to be a legitimate call — no exception, no alarm, no audit entry. The failure is invisible until someone notices access anomalies in adjacent systems. The 'authorized attacker' framing in the CVSS deserves scrutiny: it suggests the attacker already has local access, but the escalation path (service account to SYSTEM looks very different from standard user to admin) fundamentally changes the threat model. The low EPSS likely reflects limited public exploitation knowledge rather than genuine constraint, and historical precedence shows these logic flaws tend to cluster — find one in an error-handling contract, and siblings often surface. Audit your async authorization paths for any `DoSomethingAsync()` calls that lack `await`, and extend scrutiny to any legacy APM (`BeginXxx`/`EndXxx`) callbacks in authorization layers that survived framework migrations untouched.

Reviewed through automated stages and approved by a human before publication.