Microsoft Net Framework 3 5 And 4 7 2 CVE-2026-32226

CVSS 5.9 (medium) reflects a network-accessible denial-of-service with high attack complexity, but real-world risk must be contextualized. The CVSS vector (AV:N, AC:H, PR:N, UI:N, S:U, C:N, I:N, A:H) indicates unauthenticated remote access with no user interaction required, yet AC:H significantly raises the bar for reproducible exploitation-race conditions are notoriously difficult to trigger reliably in production, and this one requires specific threading or timing conditions. KEV status is not provided, suggesting no confirmed active exploitation or CISA monitoring at time of analysis. Without published POC code or exploitation reports, practical risk is constrained: defenders deploying .NET applications must patch to eliminate the theoretical attack surface, but the real probability of opportunistic remote exploitation is low compared to vulnerabilities with AC:L or POC availability. For organizations running older .NET Framework versions (3.5, 4.7.2) on internet-facing services, the network-accessible vector warrants patching; however, applications in air-gapped or load-balanced environments face lower risk. The race condition's dependence on AC:H makes this a medium priority rather than critical.

An unauthenticated attacker sends a series of specially timed network requests to a .NET Framework application, exploiting the race condition in shared resource synchronization to trigger a resource leak or deadlock. After multiple requests aligned with specific threading windows, the application exhausts available resources or enters an unrecoverable state, crashing the process or becoming unresponsive and denying service to legitimate users. The high attack complexity means the attacker likely requires reconnaissance of the target application's threading behavior or multiple retry attempts to succeed.