ASP.NET Core CVE-2026-96233

No special configuration is stated as required: the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with low complexity and no user interaction against a network-reachable ASP.NET Core / .NET service. The practical limiting factors are exposure and version: the target endpoint must be reachable by the attacker (internet-facing or network-adjacent), and the runtime must be an unpatched build below the fixed versions listed in EUVD (e.g., .NET 8.0 <8.0.32, .NET 9.0 <9.0.21, .NET 10.0 <10.0.13, and multiple .NET Framework builds). Impact is confined to availability (A:H, C:N/I:N) with scope unchanged (S:U), so successful exploitation causes service disruption rather than data exposure or code execution.

This is a network-reachable, unauthenticated denial-of-service flaw (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, base 7.5) stemming from an out-of-bounds write (CWE-787) in ASP.NET Core. The impact is availability-only (C:N/I:N/A:H), so despite the 'buffer overflow'/'memory corruption' tags there is no vendor or NVD claim of code execution - the realistic worst case is crashing or hanging the affected service. Exploitation signals are mixed but point to moderate-not-urgent priority: CISA's SSVC framework records Exploitation=none (no observed exploitation), Automatable=yes (attack can be scripted/repeated at scale), and Technical Impact=partial, which is consistent with a DoS rather than full compromise. There is no CISA KEV listing and no public proof-of-concept identified, so exploitation is theoretical at this time. EPSS is not provided in the input, so probabilistic exploitation likelihood could not be factored in - treat the '7.5 / Automatable=yes' combination as the main driver. Net: a genuine but patch-and-move-on availability issue for exposed .NET services, not an emergency RCE; prioritize based on internet exposure of the affected endpoints.

A remote, unauthenticated attacker sends specially crafted network input (e.g., a malformed HTTP request) to an exposed ASP.NET Core / .NET service, triggering an out-of-bounds write that corrupts memory and crashes the worker process, denying service to legitimate users. Because CISA SSVC rates the attack as Automatable=yes, the request can be scripted and repeated to keep the service down. No public exploit code has been identified, so an attacker would need to develop the trigger independently.