What is the CVSS score of CVE-2026-50527?

CVE-2026-50527 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Which versions of .NET Framework are affected by CVE-2026-50527?

A denial-of-service vulnerability in Microsoft .NET and .NET Framework (versions 3.5-10.0) allows unauthenticated remote attackers to crash applications without requiring administrative access.. A patch is available.

How to fix or mitigate CVE-2026-50527?

Within 24 hours, audit your infrastructure for instances of Microsoft .NET 8.0, 9.0, 10.0 or .NET Framework 3.5-4.8.1 and consult the Microsoft security advisory referenced in CVE-2026-50527. Within 7 days, obtain the vendor-released patches, test them in a non-production environment, and roll out to production systems beginning with critical and customer-facing applications. By 30 days, validate that all affected systems have been patched and confirm application stability.

.NET Framework CVE-2026-50527

EUVD-2026-44395 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-14 microsoft

GHSA-mmjf-rqrv-855v

Buffer Overflow Microsoft Stack Overflow Red Hat Suse Microsoft Net Framework 3 5 Microsoft Net Framework 3 5 And 4 7 2 Microsoft Net Framework 3 5 And 4 8 Microsoft Net Framework 3 5 And 4 8 1 Microsoft Net Framework 4 6 2 4 7 4 7 1 4 7 2 Microsoft Net Framework 4 8 Net 10 0 Net 8 0 Net 9 0 Microsoft Visual Studio 2022 Version 17 12 Microsoft Visual Studio 2022 Version 17 14 Microsoft Visual Studio 2026 Version 18 7

7.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity DoS with availability-only impact; no confidentiality or integrity loss, matching the buffer-overflow-to-crash behavior.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:43 vuln.today

CVE Published

Jul 14, 2026 - 19:29 nvd

HIGH 7.5

DescriptionCVE.org

Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.

AnalysisAI

Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) and .NET Framework (3.5 through 4.8.1) allows a remote, unauthenticated attacker to crash affected applications by triggering a stack-based buffer overflow (CWE-121) over the network. The flaw impacts availability only - there is no confidentiality or integrity loss and no code execution per the CVSS vector (A:H, C:N, I:N). Microsoft has published an advisory with fixes; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in the managed runtime and class libraries shared across Microsoft's .NET platform (the modern cross-platform .NET 8/9/10 runtimes) and the legacy Windows-only .NET Framework (3.5, 4.6.2-4.8.1), and is also redistributed inside Microsoft Visual Studio 2022 (17.12/17.14) and Visual Studio 2026 (18.7). CWE-121 (Stack-based Buffer Overflow) indicates that attacker-controlled input reaches a fixed-size stack buffer without adequate bounds checking, corrupting the stack and causing an abnormal termination. Because .NET underpins web services (ASP.NET), desktop apps, and background services, any component that parses untrusted network input using the vulnerable code path can be forced to fault. The CPE set confirms the affected products are the Microsoft .NET runtimes/frameworks themselves rather than a single downstream application.

RemediationAI

Patch available per vendor advisory: apply the latest Microsoft security updates for the affected .NET runtime and .NET Framework versions as published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50527, and update Visual Studio 2022 (17.12/17.14) and Visual Studio 2026 (18.7) to the servicing releases that bundle the fixed components. Exact fixed build numbers are not enumerated in the provided data - consult the MSRC update guide entry for the specific patch level matching your installed version. Where immediate patching is not possible, reduce exposure by restricting network reachability of the affected .NET services (place them behind a WAF/reverse proxy or firewall to filter malformed requests), and validate or rate-limit untrusted input at the perimeter; note that a proxy may not fully block the malformed input if it forwards the triggering payload, and access restrictions can break legitimate remote clients.