EUVD-2026-22591
GHSA-6588-8gv4-xfgh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing .NET application
-
DeliveryCraft malformed network request with oversized data
-
ExploitSend request to vulnerable endpoint
-
ExecutionTrigger stack buffer overflow in .NET runtime
-
ImpactApplication crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can trigger denial of service against .NET and Visual Studio installations accepting network input processed by vulnerable buffer handling. No user interaction required. Affects default network-accessible configurations accepting untrusted data. |
| Impact | The CVSS base score of 7.5 reflects a High severity rating, driven by the network attack vector, low complexity, and high availability impact. However, real-world risk is moderate rather than critical. The CVSS vector shows no confidentiality or integrity impact (C:N/I:N), limiting exploitation to denial-of-service scenarios where an attacker crashes the application or service. Attack complexity is low (AC:L) and no privileges are required (PR:N), making exploitation technically straightforward for remote attackers. From an SSVC perspective, the technical impact is partial (availability only), and while the vulnerability is automatable given the network vector and lack of authentication requirements, there is no evidence of active exploitation or weaponization. The absence of KEV listing and public exploit code further reduces immediate risk. Organizations running public-facing .NET applications or Visual Studio build environments accessible over networks should prioritize patching, but this is not an emergency-tier vulnerability like those enabling remote code execution. The primary concern is service disruption for internet-facing .NET web applications, API endpoints, or continuous integration systems using affected Visual Studio versions. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a specially crafted network request to a public-facing .NET web application or API endpoint, triggering a stack buffer overflow in the request processing pipeline. The malformed input causes the application to overwrite stack memory, resulting in an immediate crash and service outage. The attacker can repeatedly send these crafted requests to maintain persistent denial of service against the target application. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Denial of service via stack buffer overflow in .NET (versions 8.0, 9.0, 10.0) and Visual Studio 2022 (versions 17.12, 17.14) allows unauthenticated remote attackers to crash affected applications over the network. The vulnerability has a CVSS score of 7.5 (High) with low attack complexity and no privileges required. Vendor-released patches are available from Microsoft (MSRC). No public exploit identified at time of analysis, and the issue is not confirmed actively exploited.
RemediationAI
Vendor-released patches are available from Microsoft Security Response Center. Upgrade .NET 8.0 installations to version 8.0.26 or later, .NET 9.0 to version 9.0.15 or later, and .NET 10.0 to version 10.0.6 or later. For development environments, update Visual Studio 2022 version 17.12 to 17.12.19 or later, and version 17.14 to 17.14.30 or later. Apply updates through Microsoft Update, Visual Studio Installer, or download from the official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32203. Prioritize patching internet-facing .NET applications and production runtime environments first, followed by development and build systems. No effective workarounds are documented; patching is the primary mitigation strategy.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 18 packages in microsoft, nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from a classic stack-based buffer overflow (CWE-121) in the .NET runtime and Visual Studio 2022 development environment. Stack buffer overflows occur when a program writes more data to a buffer on the call stack than allocated, potentially overwriting adjacent memory including return addresses and function pointers. In this case, the overflow triggers availability impact only (CVSS A:H with C:N/I:N), suggesting the flaw causes application crashes rather than enabling code execution. The affected components span multiple major .NET releases (8.0, 9.0, 10.0) and two Visual Studio 2022 update channels (17.12, 17.14), indicating the vulnerable code exists in shared runtime components or parsing libraries used across the Microsoft development stack. The network attack vector (AV:N) suggests the overflow is triggered by processing malformed network input, potentially in HTTP request handling, serialization/deserialization routines, or protocol parsers within the .NET framework.
Know when Net 10 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
Executive ViewAI
A denial-of-service vulnerability in Microsoft .NET (versions 8.0, 9.0, 10.0) and Visual Studio 2022 (versions 17.12, 17.14) allows unauthenticated remote attackers to crash affected applications, disrupting service availability across any organization running these versions. This requires immediate patching as attackers can exploit the vulnerability over the network with no authentication or special privileges, creating direct business continuity risk for any application dependency on these platforms.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB