ASP.NET Core CVE-2026-70181

Exploitable only against ASP.NET Core applications that process request bodies through Microsoft.AspNetCore.WebUtilities FileBufferingReadStream - in practice, endpoints that accept multipart/form-data (file uploads or large form posts) where the body is buffered. The affected runtime must be an unpatched version (ASP.NET Core 8.0 <8.0.32, 9.0 <9.0.21, 10.0 <10.0.13, or the corresponding bundled Visual Studio 2022 17.14 <17.14.42 / 2026 18.10 <18.10.4 toolchains). No authentication is required (PR:N) and no special non-default configuration is needed beyond the app exposing a buffered/multipart-consuming route, so limiting factors are narrow: the primary constraint is that an attacker must reach an endpoint that triggers the vulnerable buffering path, and impact is confined to availability (no data exposure or code execution).

This is a genuine but bounded availability risk, not an overhyped high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) indicates a remotely reachable, low-complexity, unauthenticated attack with no user interaction and pure availability impact - consistent with the CWE-770 resource-exhaustion root cause where FileBufferingReadStream eagerly rents buffers during multipart processing. Signals mostly align: CISA's SSVC decision records Exploitation=none (no observed exploitation or public POC), Automatable=yes (an attacker can script repeated malicious multipart uploads to scale the attack), and Technical Impact=partial (service degradation/outage, no code execution or data compromise), which matches A:H with C:N/I:N. There is no CISA KEV listing and no public exploit identified at time of analysis, so despite the network/low-complexity profile this is a patch-in-normal-cycle priority rather than an emergency - elevated for internet-facing ASP.NET Core apps that accept file uploads because Automatable=yes makes opportunistic abuse plausible. Note: no EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed; the 'Automatable: yes' SSVC flag is the strongest forward-looking risk signal here.

An attacker sends a stream of crafted multipart/form-data requests to an internet-facing ASP.NET Core endpoint that buffers request bodies (e.g., a file-upload or form-handling route), each request causing FileBufferingReadStream to eagerly rent large buffers. Repeated and concurrent requests exhaust process/server memory, crashing or hanging the application and denying service to legitimate users. No authentication or user interaction is required (PR:N/UI:N) and complexity is low (AC:L); no public exploit code is identified at time of analysis.