Skip to main content

Microsoft Net Framework 3 5 And 4 7 2 CVE-2026-32226

| EUVD-2026-22614 MEDIUM
Race Condition (CWE-362)
2026-04-14 microsoft GHSA-fpfg-hmcm-qvcj
Authentication Bypass Race Condition Microsoft Net Framework 3 5 And 4 7 2 Microsoft Net Framework 3 5 And 4 8 Microsoft Net Framework 3 5 And 4 8 1 Microsoft Net Framework 4 8
5.9
CVSS 3.1 · NVD
Temporal: 5.2
Share

Severity by source

NVD PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
ENISA EUVD
HIGH
qualitative
CIRCL (temporal)
5.2 MEDIUM
cvss
Red Hat
5.9 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Apr 14, 2026 - 19:41 vuln.today
EUVD ID Assigned
Apr 14, 2026 - 17:46 euvd
EUVD-2026-22614
Analysis Generated
Apr 14, 2026 - 17:46 vuln.today
Patch released
Apr 14, 2026 - 17:46 nvd
Patch available
CVE Published
Apr 14, 2026 - 16:57 nvd
MEDIUM 5.9

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network.

AnalysisAI

Denial of service in Microsoft .NET Framework 3.5 and 4.7.2-4.8.1 via race condition in shared resource synchronization allows unauthenticated remote attackers to crash affected applications with high complexity attack requirements. Microsoft has released patches addressing improper concurrent access handling across multiple .NET Framework versions.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Probe target .NET application via network
Delivery
Craft timing-sensitive requests
Exploit
Trigger race condition in resource handler
Execution
Exhaust or corrupt shared resource
Persist
Application crash or hang
Impact
Service denial
Sign in to reveal

Vulnerability AssessmentAI

Risk Assessment CVSS 5.9 (medium) reflects a network-accessible denial-of-service with high attack complexity, but real-world risk must be contextualized. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker sends a series of specially timed network requests to a .NET Framework application, exploiting the race condition in shared resource synchronization to trigger a resource leak or deadlock. After multiple requests aligned with specific threading windows, the application exhausts available resources or enters an unrecoverable state, crashing the process or becoming unresponsive and denying service to legitimate users. …
Remediation Apply vendor-released patch from Microsoft Security Response Center immediately. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Vendor StatusVendor

Share

CVE-2026-32226 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy