EUVD-2026-100203
GHSA-87vj-4hqv-22p9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ASP.NET Core endpoint
-
DeliverySend crafted malformed request
-
ExploitTrigger out-of-bounds write
-
ExecutionCrash worker process
-
ImpactService denial to users
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration is stated as required: the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with low complexity and no user interaction against a network-reachable ASP.NET Core / .NET service. The practical limiting factors are exposure and version: the target endpoint must be reachable by the attacker (internet-facing or network-adjacent), and the runtime must be an unpatched build below the fixed versions listed in EUVD (e.g., .NET 8.0 <8.0.32, .NET 9.0 <9.0.21, .NET 10.0 <10.0.13, and multiple .NET Framework builds). Impact is confined to availability (A:H, C:N/I:N) with scope unchanged (S:U), so successful exploitation causes service disruption rather than data exposure or code execution. |
| Impact | This is a network-reachable, unauthenticated denial-of-service flaw (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, base 7.5) stemming from an out-of-bounds write (CWE-787) in ASP.NET Core. The impact is availability-only (C:N/I:N/A:H), so despite the 'buffer overflow'/'memory corruption' tags there is no vendor or NVD claim of code execution - the realistic worst case is crashing or hanging the affected service. Exploitation signals are mixed but point to moderate-not-urgent priority: CISA's SSVC framework records Exploitation=none (no observed exploitation), Automatable=yes (attack can be scripted/repeated at scale), and Technical Impact=partial, which is consistent with a DoS rather than full compromise. There is no CISA KEV listing and no public proof-of-concept identified, so exploitation is theoretical at this time. EPSS is not provided in the input, so probabilistic exploitation likelihood could not be factored in - treat the '7.5 / Automatable=yes' combination as the main driver. Net: a genuine but patch-and-move-on availability issue for exposed .NET services, not an emergency RCE; prioritize based on internet exposure of the affected endpoints. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted network input (e.g., a malformed HTTP request) to an exposed ASP.NET Core / .NET service, triggering an out-of-bounds write that corrupts memory and crashes the worker process, denying service to legitimate users. Because CISA SSVC rates the attack as Automatable=yes, the request can be scripted and repeated to keep the service down. No public exploit code has been identified, so an attacker would need to develop the trigger independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An out-of-bounds write (CWE-787) in ASP.NET Core and the associated .NET runtimes lets a remote, unauthenticated attacker trigger memory corruption that crashes or destabilizes a network-reachable service, yielding a full loss of availability (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation requires no credentials, no user interaction, and no special configuration - only that the target endpoint be reachable and running an unpatched build (for example .NET 8.0 below 8.0.32, .NET 9.0 below 9.0.21, or .NET 10.0 below 10.0.13). There is no public exploit identified at time of analysis and CISA's SSVC rates exploitation as "none" while marking the flaw fully automatable, so scripted denial-of-service attempts remain a plausible near-term risk; vendor patches are available.
RemediationAI
Apply the vendor patch: Microsoft has released fixes and patch data is available per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96233. For the modern runtime, update ASP.NET Core hosts to .NET 8.0.32 or later, .NET 9.0.21 or later, .NET 10.0.13 or later, or .NET 11.0.0-rc.2 or later; for Windows .NET Framework, install the corresponding security update to reach .NET Framework 4.8.4811.0 (4.8), 4.8.9363.0 (4.8.1), 4.7.4150.0 (4.6.2/4.7/4.7.1/4.7.2), and the 3.5 components 2.0.50727.9188 and 3.0.30729.9171 (with 2.0.50727.9073 / 3.0.30729.9070 / 2.0.50727.8987 / 3.0.30729.8982 for the older 3.5 combinations). Because PR:N/AC:L/UI:N means no authentication or interaction prerequisite, prioritize internet-facing and network-adjacent ASP.NET Core endpoints, and note that host-level patching must be repeated for every side-by-side runtime installed on a machine. If immediate patching is impossible, compensating controls are limited and each has trade-offs: restrict inbound access to the vulnerable application via firewall, security group, or reverse-proxy allowlists, accepting reduced reachability for legitimate users; terminate traffic at a WAF or proxy that enforces strict request-size and header-count limits to blunt oversized-payload triggers, accepting added latency and possible false positives on legitimate large requests; and configure process-level auto-restart/health probes so a crashed worker recovers quickly, accepting that restart loops still produce repeated intermittent outages. No public exploit code was identified at time of analysis, so these measures should be treated as temporary until the vendor update is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 19 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is an out-of-bounds write (CWE-787), a memory-safety defect in which a buffer in the ASP.NET Core request-processing stack is written past its allocated bounds, corrupting adjacent heap or stack memory. In managed .NET code this class of bug typically surfaces where native or unsafe code interops with managed buffering - for instance parsers, header/body framing, or serialization paths in Kestrel and the shared framework - and the resulting corruption produces a buffer overflow/memory-corruption condition that terminates or hangs the worker process rather than disclosing data or executing attacker code. The CVSS vector (S:U, C:N, I:N, A:H) confirms impact is confined to availability with scope unchanged, and the SSVC "Automatable: yes" designation indicates the trigger can be delivered reliably and at scale without manual tailoring, consistent with a low-complexity (AC:L) remote (AV:N) unauthenticated (PR:N) request. The defect spans both the modern cross-platform .NET runtime (8.0, 9.0, 10.0, and the 11.0 release candidate) and the Windows-only .NET Framework line (3.5, 4.6.2 through 4.8.1), meaning the same exposed parsing surface is reachable from legacy ASP.NET applications as well as current ASP.NET Core deployments.
Know when .NET gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, unauthenticated, low-complexity trigger (AV:N/AC:L/PR:N/UI:N) with availability-only denial-of-service impact (A:H) and no confidentiality/integrity effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Technical POC Analysis
The advisory classifies the flaw as CWE-787 (Out-of-bounds Write) and places it in System.Runtime, not in ASP.NET Core itself.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
ASP.NET Core and associated .NET runtimes are affected by a high-severity availability flaw that can let an unauthenticated remote attacker crash or destabilize network-reachable services without user interaction. Because exploitation requires only reachability to an unpatched endpoint and can be automated, internet-facing or business-critical .NET applications could suffer disruptive outages until patched. Leadership should prioritize inventory and remediation of affected .NET 8.0, 9.0, and 10.0 deployments, particularly customer-facing services with high availability requirements.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote code execution affects Windows desktop applications built on the Microsoft.WindowsDesktop.App.Runtime (WPF) compo
Changjetong T+ (through 16.x) has .NET deserialization RCE in an AjaxPro endpoint. Attacker-controlled JSON triggers des
SQL injection (CWE-89) in Marten, the .NET transactional document DB and event store for PostgreSQL, affects versions 7.
Argument injection in the CliInvoke .NET process-wrapping library (and its former identity, AlastairLundy.CliInvoke) all
SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL st
PowerDocu versions prior to 2.4.0 allow arbitrary .NET object instantiation and code execution through unsafe deserializ
Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a net
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML
Asp.Net-Core-Inventory-Order-Management-System versions up to 9.20250118. contains a security vulnerability (CVSS 6.3).
Remote code execution in the ActiveMQ NMS AMQP .NET client affects all releases up to and including 2.3.0 when the clien
Exploit-DB