Microsoft .NET Framework CVE-2026-96958

The target must be a network-reachable application built on the affected Microsoft .NET Framework (3.5 through 4.8.1) or the System.Security.Cryptography.Xml package that parses attacker-supplied input via the vulnerable code path; the affected-component list points specifically at XML/cryptographic-XML processing (e.g. XML signature verification, SAML, or similar document parsing). No authentication is required (CVSS PR:N) and no user interaction (UI:N), so any endpoint that accepts and processes such input from the network is exposed. Limiting factors: the vulnerable application must actually accept and process the crafted input, impact is confined to availability (no data disclosure or code execution, C:N/I:N), and systems patched to the fixed versions (e.g. .NET Framework 4.8 >=4.8.4811.0, System.Security.Cryptography.Xml >=10.0.13) are not affected.

Signals are moderate and internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remote, unauthenticated, low-complexity denial of service with availability-only impact - no confidentiality or integrity loss - which matches CWE-407 (algorithmic complexity) and the description. CISA's SSVC framework aligns: Exploitation=none (no observed activity), Automatable=yes (a DoS trigger is trivially scriptable once known), Technical Impact=partial (service disruption, not system takeover). There is no EPSS score, no CISA KEV listing, and no public POC provided, so this is NOT confirmed as actively exploited - it is a credible-but-unproven risk rather than an urgent in-the-wild emergency. Note a data conflict to verify: the input Tag 'Authentication Bypass' contradicts every other signal (this is a DoS with C:N/I:N and no auth-bypass semantics in CWE-407 or the description) and appears mislabeled - do not treat this as an authentication-bypass issue. Overall this is a legitimate patch-soon item for internet-facing .NET services, but it is an availability-only DoS, not a high-real-risk code-execution flaw.

An attacker sends specially crafted input (e.g. a malformed XML document or payload processed by the affected System.Security.Cryptography.Xml / .NET Framework parsing path) to a network-exposed .NET application. Because of inefficient algorithmic complexity, processing the input consumes disproportionate CPU/memory, exhausting resources and rendering the service unresponsive to legitimate users. No public exploit code is identified at time of analysis, but CVSS AC:L and SSVC 'Automatable: yes' indicate the trigger would be simple to script once the input pattern is known.