ASP.NET Core CVE-2026-109468

Exploitation requires a network-reachable service built on the affected component (ASP.NET Core / System.Formats.Cbor) that accepts and parses attacker-controlled input through a code path lacking resource throttling. No authentication and no user interaction are required (PR:N/UI:N), so any exposed endpoint is reachable. The practical limiting factor is reachability and actual use of the vulnerable parsing path: a System.Formats.Cbor or Visual Studio deployment that never processes untrusted external CBOR/network input is not realistically exploitable, and services behind request-size/rate limiting, timeouts, or a WAF have reduced exposure. Impact is confined to availability - no data disclosure or code execution.

All signals point to a genuine but bounded denial-of-service risk rather than a critical compromise. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) indicates a network-reachable, low-complexity, unauthenticated attack with high availability impact but ZERO confidentiality or integrity impact - consistent with CWE-770 (allocation of resources without limits/throttling). There is no code execution or data exposure here; the worst outcome is service unavailability. No EPSS score, SSVC decision, KEV listing, or POC was supplied, so exploitation likelihood cannot be quantified from the input; at time of analysis there is no public exploit identified and no evidence of active exploitation. One notable data conflict: the Description attributes the flaw to 'ASP.NET Core,' but the affected CPEs and Tags name System.Formats.Cbor and Microsoft Visual Studio 2022/2026 - verify with the Microsoft MSRC advisory which component you actually run, since the real exposure (a public-facing ASP.NET Core service vs. a developer-only Visual Studio/CBOR library) changes the priority materially. Net: patch on a normal cadence for internet-facing services; this is a high-CVSS availability issue, not a confirmed-exploited emergency.

A remote, unauthenticated attacker sends specially crafted or high-volume network input (plausibly CBOR-encoded data handled by System.Formats.Cbor within an ASP.NET Core endpoint) that the application processes without enforcing resource limits. Because allocation is unbounded, the input forces excessive memory or CPU consumption, exhausting resources and rendering the service unavailable to legitimate users. No public exploit code is identified at time of analysis, and the attack yields no data access or code execution - only denial of service.