What is the CVSS score of CVE-2026-33116?

CVE-2026-33116 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.9%.

Which versions of Microsoft Net Framework 3 5 are affected by CVE-2026-33116?

CVE-2026-33116 is a high-severity denial-of-service vulnerability affecting Microsoft .NET Framework 3.5-4.8.1 and .NET 8.0-10.0 that allows unauthenticated remote attackers to crash .NET…. A patch is available.

Is there a public PoC exploit available for CVE-2026-33116?

Yes, a public proof-of-concept exploit is available for CVE-2026-33116. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-33116?

Within 24 hours: Identify all systems running affected .NET versions (Framework 3.5-4.8.1, .NET 8.0, 9.0, 10.0) and prioritize internet-facing applications. Within 7 days: Apply vendor-released patches to all affected .NET Framework and .NET runtime installations; consult Microsoft Security Advisory for specific version numbers. Within 30 days: Complete remediation across all environments, validate patch deployment, and review network segmentation to restrict direct access to .NET services from untrusted sources.

Microsoft Net Framework 3 5 CVE-2026-33116

EUVD-2026-22635 HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-04-14 microsoft

GHSA-37gx-xxp4-5rgx

Denial Of Service Microsoft Microsoft Net Framework 3 5 Microsoft Net Framework 3 5 And 4 7 2 Microsoft Net Framework 3 5 And 4 8 Microsoft Net Framework 3 5 And 4 8 1 Microsoft Net Framework 4 6 2 4 7 4 7 1 4 7 2 Microsoft Net Framework 4 8 Net 10 0 Net 8 0 Net 9 0

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.5 MEDIUM

cvss

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

PoC Detected

Apr 17, 2026 - 15:10 vuln.today

Public exploit code

Analysis Generated

Apr 14, 2026 - 19:24 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22635

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

HIGH 7.5

DescriptionCVE.org

Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.

AnalysisAI

Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to exhaust server resources via specially crafted network requests. The vulnerability (CWE-835) stems from unreachable loop exit conditions in core .NET processing logic, enabling complete service disruption with low attack complexity. Vendor-released patches are available across all affected product lines. No public exploit identified at

Technical ContextAI

This vulnerability exploits CWE-835 (Loop with Unreachable Exit Condition), a class of defects where program logic enters an iterative loop that cannot terminate due to flawed exit condition evaluation. In the .NET runtime and framework context, this manifests when processing certain network inputs triggers parsing or validation routines with infinite recursion or iteration paths. The affected CPE strings span Microsoft .NET Framework legacy versions (3.5, 4.6.2-4.8.1) used in Windows Server environments and modern cross-platform .NET implementations (8.0, 9.0, 10.0). The CVSS vector confirms network-accessible exploitation (AV:N) with no required privileges (PR:N) or user interaction (UI:N), indicating the vulnerable code paths are exposed through public-facing network services like ASP.NET applications, WCF endpoints, or HTTP handlers. The high availability impact (A:H) with unchanged scope (S:U) suggests resource exhaustion affects only the vulnerable component rather than cascading to other systems.

RemediationAI

Apply vendor-released security updates immediately for all affected .NET installations. For .NET 8.0, upgrade to version 8.0.26 or later. For .NET 9.0, upgrade to version 9.0.15 or later. For .NET 10.0, upgrade to version 10.0.6 or later. For .NET Framework 4.8 standalone, upgrade to version 4.8.4801.0 or later. For .NET Framework combination packages (3.5+4.7.2, 3.5+4.8, 3.5+4.8.1), apply cumulative updates meeting minimum build thresholds specified in the Microsoft Security Response Center advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33116). For .NET Framework 3.5 standalone, upgrade to builds 2.0.50727.8982/3.0.30729.8976 or later. Patches are distributed through Windows Update, Microsoft Update Catalog, and .NET SDK installers depending on deployment model. No effective workarounds exist beyond applying patches, though rate-limiting and web application firewall rules may provide partial mitigation by throttling malicious request patterns. Verify patch application using dotnet --list-runtimes and dotnet --list-sdks commands or by checking installed Windows updates for framework versions.