EUVD-2026-44278
GHSA-rp2p-6cmp-jxj9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, unauthenticated, low-complexity input triggers a crash with no user interaction; impact is availability-only, so C:N/I:N/A:H and S:U.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.
AnalysisAI
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or hang affected applications by triggering a type-confusion condition (CWE-843) over the network. The flaw was reported by Microsoft and a vendor patch is available via MSRC; there is no public exploit identified at time of analysis. The CVSS vector limits impact strictly to availability (A:H, C:N/I:N), meaning it is a service-disruption bug rather than a code-execution or data-exposure issue despite tag noise suggesting otherwise.
Technical ContextAI
.NET is Microsoft's cross-platform managed runtime and framework used to build and host web services, APIs, and applications. The root cause is CWE-843, 'Access of Resource Using Incompatible Type' (type confusion), in which the runtime treats a region of memory or an object as a type different from its actual type. In a memory-managed runtime this typically surfaces during deserialization, parsing, or reflection paths where attacker-influenced input causes the runtime to misinterpret object layout, leading to an unhandled exception or abort rather than a controlled outcome. The affected CPEs are cpe:2.3:a:microsoft:.net_10.0, cpe:2.3:a:microsoft:.net_9.0, and cpe:2.3:a:microsoft:.net_8.0, indicating all three currently supported .NET lines are impacted.
RemediationAI
Patch available per vendor advisory: apply the Microsoft .NET servicing update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57108 for your installed line (8.0, 9.0, or 10.0), updating both the runtime and, where applicable, the SDK; exact fixed build numbers should be taken from that MSRC page as they are not provided in this dataset. Redeploy or restart affected services after updating so the patched runtime is loaded. Where immediate patching is not possible, reduce exposure by restricting network reachability of affected .NET services to trusted clients (firewall/allowlist), placing a reverse proxy or WAF in front of internet-facing endpoints to reject malformed input, and enabling automatic process restart/health-check recycling so a triggered crash self-heals - with the trade-off that request filtering may not catch the specific malformed payload and auto-restart only limits downtime rather than preventing the DoS.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today