EUVD-2026-44392
GHSA-w7cw-xp7h-6j5j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, low-complexity, unauthenticated input-validation DoS with no user interaction; impact limited to availability, so C:N/I:N/A:H and S:U.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.
AnalysisAI
Remote denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows an unauthenticated network attacker to crash or hang the runtime by sending crafted input that fails proper type validation (CWE-1287). The flaw carries a CVSS 7.5 rating driven entirely by availability impact (A:H) with no confidentiality or integrity loss, and no public exploit has been identified at time of analysis. Microsoft has released a patch; there is no indication of active exploitation.
Technical ContextAI
The affected component is the Microsoft .NET runtime and its associated tooling (the CPE data confirms .NET 8.0, 9.0, and 10.0, plus Visual Studio 2022 versions 17.12/17.14 and Visual Studio 2026 version 18.7, which bundle the affected SDK/runtime). The root cause is classified as CWE-1287, Improper Validation of Specified Type of Input, meaning the runtime accepts data whose declared or assumed type does not match its actual structure and fails to reject it safely. When such malformed/mistyped input reaches a vulnerable parsing or deserialization path, it drives the process into an unhandled error state or resource exhaustion, terminating availability. Because .NET underpins ASP.NET Core web services and networked applications, the parsing path is reachable over the network, consistent with the AV:N vector.
RemediationAI
Patch available per vendor advisory: apply the Microsoft update for the affected .NET release train (8.0, 9.0, or 10.0) and update Visual Studio 2022 (17.12/17.14) and Visual Studio 2026 (18.7) to their patched builds as listed in the MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50524; exact fixed version numbers are not included in the provided data and should be taken from that advisory. Because self-contained deployments bundle the runtime, rebuild and redeploy those applications with the patched SDK rather than relying only on machine-wide runtime updates. Until patching is complete, reduce exposure of internet-facing .NET/ASP.NET Core endpoints by placing them behind a reverse proxy or WAF that validates request structure and size, applying rate limiting to blunt repeated crash attempts, and restricting network access to trusted clients where feasible - noting these controls reduce but do not eliminate the DoS risk and may affect legitimate traffic if tuned too aggressively.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today