What is the CVSS score of CVE-2026-50527?

CVE-2026-50527 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

How to fix or mitigate CVE-2026-50527?

Within 24 hours, audit your infrastructure for instances of Microsoft .NET 8.0, 9.0, 10.0 or .NET Framework 3.5-4.8.1 and consult the Microsoft security advisory referenced in CVE-2026-50527. Within 7 days, obtain the vendor-released patches, test them in a non-production environment, and roll out to production systems beginning with critical and customer-facing applications. By 30 days, validate that all affected systems have been patched and confirm application stability.

.NET Framework CVE-2026-50527

Q: Which versions of .NET Framework are affected by CVE-2026-50527?

A denial-of-service vulnerability in Microsoft .NET and .NET Framework (versions 3.5-10.0) allows unauthenticated remote attackers to crash applications without requiring administrative access.. A patch is available.

EUVD-2026-44395 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-14 microsoft

GHSA-mmjf-rqrv-855v

Buffer Overflow Microsoft Stack Overflow Microsoft Net Framework 3 5 Microsoft Net Framework 3 5 And 4 7 2 Microsoft Net Framework 3 5 And 4 8 Microsoft Net Framework 3 5 And 4 8 1 Microsoft Net Framework 4 6 2 4 7 4 7 1 4 7 2 Microsoft Net Framework 4 8 Net 10 0 Net 8 0 Net 9 0 Microsoft Visual Studio 2022 Version 17 12 Microsoft Visual Studio 2022 Version 17 14 Microsoft Visual Studio 2026 Version 18 7

7.5

CVSS 3.1 · Vendor: microsoft

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach network-exposed .NET service
Delivery

Send crafted malformed input
Exploit

Overflow fixed-size stack buffer
Execution

Corrupt stack and fault process
Impact

Service crashes (denial of service)

Vulnerability Assessment

Weakness	CWE CWE-121 ASVS 5.0 V15 - Secure Coding and Architecture Stack buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond network reachability - remote unauthenticated exploitation is possible against affected .NET and .NET Framework applications that process attacker-supplied input over the network. The concrete prerequisite is that a vulnerable .NET/.NET Framework runtime component (versions listed above) is exposed to attacker-controlled network input; the limiting factor is that the target application must actually invoke the vulnerable parsing code path on that input, and the impact is confined to denial of service (crash), with no data disclosure, code execution, or integrity loss. Non-network-facing or input-isolated .NET workloads are not realistically exploitable.
Impact	The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a network-reachable, low-complexity, unauthenticated attack whose entire severity comes from availability impact - this is a pure DoS, not an RCE, despite the buffer-overflow root cause. No EPSS score was provided, the vulnerability is not in CISA KEV, and no POC or exploit code is referenced, so real-world exploitation pressure is currently low and speculative rather than confirmed. The signals are internally consistent (no conflict between vector and description), and the primary risk driver is the extremely broad deployment footprint of .NET, which raises the aggregate exposure even though the per-target impact is limited to service disruption. Priority should be moderate-to-high for internet-facing .NET services that process untrusted input, and lower for isolated or non-network-exposed deployments.
Exploit ScenarioDerived	An attacker sends a specially crafted network request or malformed input to an internet-exposed .NET or ASP.NET service, overflowing a fixed-size stack buffer during parsing and crashing the worker process. Repeating the request keeps the service offline, producing a denial of service against any consumers of that application. No public exploit code has been identified, and given AV:N/AC:L/PR:N the attack requires no authentication, no user interaction, and only low complexity.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) and .NET Framework (3.5 through 4.8.1) allows a remote, unauthenticated attacker to crash affected applications by triggering a stack-based buffer overflow (CWE-121) over the network. The flaw impacts availability only - there is no confidentiality or integrity loss and no code execution per the CVSS vector (A:H, C:N, I:N). Microsoft has published an advisory with fixes; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

RemediationAI

Patch available per vendor advisory: apply the latest Microsoft security updates for the affected .NET runtime and .NET Framework versions as published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50527, and update Visual Studio 2022 (17.12/17.14) and Visual Studio 2026 (18.7) to the servicing releases that bundle the fixed components. Exact fixed build numbers are not enumerated in the provided data - consult the MSRC update guide entry for the specific patch level matching your installed version. Where immediate patching is not possible, reduce exposure by restricting network reachability of the affected .NET services (place them behind a WAF/reverse proxy or firewall to filter malformed requests), and validate or rate-limit untrusted input at the perimeter; note that a proxy may not fully block the malformed input if it forwards the triggering payload, and access restrictions can break legitimate remote clients.

Affected VersionsENISA

Microsoft .NET Framework 3.5 AND 4.8 4.8.0 <2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0

Microsoft .NET Framework 4.8 4.8.0 <4.8.4803.0

Microsoft Visual Studio 2022 version 17.12 17.12.0 <17.12.22

Microsoft Visual Studio 2026 version 18.7 18.0 <18.7.4

Microsoft Visual Studio 2022 version 17.14 17.14.0 <17.14.36

.NET 10.0 10.0.0 <10.0.6

Microsoft .NET Framework 3.5 AND 4.7.2 4.7.0 <2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0

Microsoft .NET Framework 3.5 3.5.0 <2.0.50727.8983 & 3.0.30729.8978

Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.0 <4.7.4143.0

.NET 8.0 8.0.0 <8.0.29

.NET 9.0 9.0.0 <9.0.18

Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1 <2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0

Affected Packages

nuget system.security.cryptography.xml fix: 8.0.4, 9.0.18, 10.0.10

euvd microsoft_net_framework_3_5_3_5_0_2_0_50727_8983 no fix

euvd microsoft_net_framework_3_5_and_4_7_2_4_7_0_2_0_50727_9069_3_0_30729_9067 no fix

euvd microsoft_net_framework_3_5_and_4_8_1_4_8_1_2_0_50727_9182_3_0_30729_9168 no fix

euvd microsoft_net_framework_3_5_and_4_8_4_8_0_2_0_50727_9069_3_0_30729_9067 no fix

euvd microsoft_net_framework_4_6_2_4_7_4_7_1_4_7_2 fix: 4.7.4143.0

euvd microsoft_net_framework_4_8 fix: 4.8.4803.0

euvd microsoft_visual_studio_2022_version_17_12 fix: 17.12.22

euvd microsoft_visual_studio_2022_version_17_14 fix: 17.14.36

euvd microsoft_visual_studio_2026_version_18_7 fix: 18.7.4

euvd net_10_0 fix: 10.0.6

euvd net_8_0 fix: 8.0.29

euvd net_9_0 fix: 9.0.18

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 13 packages in nuget, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the managed runtime and class libraries shared across Microsoft's .NET platform (the modern cross-platform .NET 8/9/10 runtimes) and the legacy Windows-only .NET Framework (3.5, 4.6.2-4.8.1), and is also redistributed inside Microsoft Visual Studio 2022 (17.12/17.14) and Visual Studio 2026 (18.7). CWE-121 (Stack-based Buffer Overflow) indicates that attacker-controlled input reaches a fixed-size stack buffer without adequate bounds checking, corrupting the stack and causing an abnormal termination. Because .NET underpins web services (ASP.NET), desktop apps, and background services, any component that parses untrusted network input using the vulnerable code path can be forced to fault. The CPE set confirms the affected products are the Microsoft .NET runtimes/frameworks themselves rather than a single downstream application.

Know when Microsoft Net Framework 3 5 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD HIGH

vuln.today AI 7.5 HIGH

Network-reachable, unauthenticated, low-complexity DoS with availability-only impact; no confidentiality or integrity loss, matching the buffer-overflow-to-crash behavior.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 7.5 HIGH

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.

Executive ViewAI

Why It Matters

A denial-of-service vulnerability in Microsoft .NET and .NET Framework (versions 3.5-10.0) allows unauthenticated remote attackers to crash applications without requiring administrative access. This impacts service availability across organizations relying on these runtimes and demands urgent patching to prevent operational disruptions.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.6%

Top 54% exploitable

Prevalence

Ubiquitous

core Microsoft runtime present across most Windows/enterprise environments

Threat Intel

1 sources

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

9 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment NCSC-NL GHSA MSRC Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.6%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: +5

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.