EUVD-2026-44407
GHSA-74jp-vm22-8q8x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-exploitable spoofing requires low-privilege credentials (PR:L); high integrity impact from output injection; no confidentiality or availability impact aligns with pure spoofing behavior.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to manipulate encoded output, enabling content or identity spoofing with high integrity impact. Affected products span three active .NET generations plus Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7), creating a broad enterprise attack surface. A publicly available proof-of-concept exploit exists on GitHub; however, CISA SSVC reports exploitation status as none and EPSS sits at 0.41% (34th percentile), suggesting opportunistic rather than widespread active threat activity at time of analysis.
Technical ContextAI
The root cause is CWE-116 (Improper Encoding or Escaping of Output), a class of flaw where a framework fails to properly sanitize special characters when generating network output - such as HTTP headers, HTML, XML, or JSON - allowing injected content to be misinterpreted by downstream consumers or services. CPE data confirms three distinct .NET runtime generations are affected: cpe:2.3:a:microsoft:.net_8.0, cpe:2.3:a:microsoft:.net_9.0, and cpe:2.3:a:microsoft:.net_10.0, as well as the Microsoft Visual Studio 2022 IDE (channels 17.12 and 17.14) and Visual Studio 2026 (channel 18.7). The flaw resides in .NET's output encoding subsystem; any application relying on the framework's built-in escaping utilities to construct network-facing responses is potentially affected. The specific API surface (e.g., HtmlEncoder, HttpUtility, or header encoding routines) is not disclosed in the available NVD or MSRC data.
RemediationAI
The primary fix is to upgrade to vendor-released patched versions: .NET 8.0 to 8.0.29 or later, .NET 9.0 to 9.0.18 or later, and .NET 10.0 to 10.0.6 or later. For Visual Studio users, upgrade to Visual Studio 2022 17.12.22 or later (17.12 channel), 17.14.36 or later (17.14 channel), or Visual Studio 2026 18.7.4 or later (18.7 channel). Full patch guidance is published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50659; Ubuntu package updates are documented at https://ubuntu.com/security/notices/USN-8553-1. If immediate patching is not operationally feasible, compensating controls include restricting network access to .NET application endpoints to known-trusted principals to reduce the exploitable low-privileged attacker pool - note this introduces access-control overhead and does not eliminate the flaw. Additionally, audit application-layer output encoding for any custom escaping logic that may compound this framework-level defect. No patch-free mitigation fully addresses the root encoding flaw.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today