Skip to main content

.NET CVE-2026-62901

| EUVDEUVD-2026-56409 HIGH
Unchecked Input for Loop Condition (CWE-606)
2026-08-11 secure@microsoft.com GHSA-m93f-wj8c-rp8p
Authentication Bypass Visual Studio 2022 Visual Studio 2026 Net Red Hat
7.5
CVSS 3.1 · Vendor: microsoft
Share

Severity by source

Vendor (microsoft) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ENISA EUVD
HIGH
qualitative
vuln.today AI
7.5 HIGH

Network-reachable, no auth or interaction required; impact is availability-only with no confidentiality or integrity consequence per description and CVSS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Generated
Aug 11, 2026 - 18:59 vuln.today
Patch available
Aug 11, 2026 - 18:19 EUVD
CVE Published
Aug 11, 2026 - 17:18 nvd
HIGH 7.5

DescriptionCVE.org

Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.

AnalysisAI

Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang .NET applications by supplying crafted input that exploits an unchecked loop termination condition. Affected are .NET 8.0 (all releases through 8.0.29), .NET 9.0 (through 9.0.18), .NET 10.0 (through 10.0.10), and bundled Visual Studio 2022 and 2026 installations. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send crafted network request to .NET service
Delivery
Trigger unchecked loop condition in input parser
Exploit
Loop iterates without bound
Execution
CPU/memory exhausted in target process
Persist
Service becomes unresponsive
Impact
Legitimate users denied access
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions beyond network reachability are required for exploitation - the CVSS vector AV:N/AC:L/PR:N/UI:N indicates unauthenticated remote exploitation against default configurations of .NET 8.0, 9.0, and 10.0 applications with any network-facing endpoint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 7.5 (High) is supported by the AV:N/AC:L/PR:N/UI:N vector, meaning any network-reachable .NET service is potentially reachable with a trivially crafted payload and no credential requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated remote attacker sends a specially crafted network request - such as a malformed HTTP body, serialized object, or protocol message - to a .NET 8.0, 9.0, or 10.0 application. The payload contains input that causes the .NET runtime to enter a loop that never satisfies its exit condition, consuming CPU cycles or memory until the application process becomes unresponsive or crashes, denying service to all legitimate users. …
Remediation The primary remediation is to upgrade to the patched release for each affected product: .NET 8.0.30, .NET 9.0.19, .NET 10.0.11, Visual Studio 2022 17.14.38, or Visual Studio 2026 18.8.3. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all .NET applications in production and development, categorize by business criticality and external exposure, and verify current version status against affected releases (8.0 through 8.0.29, 9.0 through 9.0.18, 10.0 through 10.0.10) and Visual Studio 2022/2026. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Visual Studio 2022

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2023-38180 HIGH
7.5 Aug 08

.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
CVE-2025-26682 HIGH
7.5 Apr 08

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove
CVE-2026-62886 HIGH POC
7.8 Aug 11

Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
CVE-2026-62871 HIGH POC
7.8 Aug 11

Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
CVE-2026-70354 HIGH POC
7.8 Aug 11

Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full

CVE-2026-62909 HIGH POC
7.8 Aug 11

Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows

CVE-2026-62897 HIGH POC
7.0 Aug 11

Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
CVE-2026-62898 HIGH POC
7.5 Aug 11

Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
CVE-2026-62899 MEDIUM POC
5.9 Aug 11

HTTP request smuggling in System.Net.HttpListener across .NET 8.0, 9.0, and 10.0 enables unauthenticated remote attacker
CVE-2024-43498 CRITICAL
9.8 Nov 12

.NET and Visual Studio Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is re
CVE-2023-36049 CRITICAL
9.8 Nov 14

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this v

Same weakness CWE-606 – Unchecked Input for Loop Condition

View all
CVE-2026-1519 HIGH POC
7.5
CVE-2024-34486 HIGH POC
7.5
CVE-2019-25624 MEDIUM POC
6.2
CVE-2026-71439 MEDIUM POC
5.3
CVE-2026-20301 HIGH
8.6
CVE-2026-23689 HIGH
7.7
CVE-2026-27689 HIGH
7.7
CVE-2022-3252 HIGH
7.5

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

Share

CVE-2026-62901 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy