Microsoft .NET EUVD-2026-100324

Exploitation requires a target application that parses attacker-supplied signed or encrypted XML using the vulnerable System.Security.Cryptography.Xml / System.Private.Xml code paths (e.g. XML digital signature verification, SAML/WS-Security processing) on an affected .NET or .NET Framework version. While the CVSS vector is AV:N/PR:N/UI:N (no authentication or user interaction at the network layer), the practical limiting factor is that the service must actually expose and invoke XML signature/encryption validation on untrusted input; purely internal or non-XML .NET workloads are not reachable. Impact is confined to availability (process crash/hang); there is no data exposure or code execution.

This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) describes a remotely reachable, low-complexity, unauthenticated denial of service with pure availability impact and no confidentiality or integrity loss, consistent with CWE-674 uncontrolled recursion. Multiple signals agree it is NOT an active-exploitation emergency: it is absent from CISA KEV, SSVC records Exploitation as 'none', and no POC was supplied, so the correct status is 'no public exploit identified at time of analysis.' Countervailing signals keep it above routine: SSVC marks it Automatable=yes (a crafted payload can be scripted and sprayed) with partial technical impact, and the affected product (.NET / .NET Framework) is enormously widespread. A key scoping caveat: although the raw CVSS reads as remote-unauthenticated against any .NET process, the GHSA advisory shows the flaw lives specifically in System.Security.Cryptography.Xml and System.Private.Xml (signed/encrypted XML processing), so real-world reachability depends on whether an application actually parses attacker-controlled signed XML - the network vector is real only for services exposing that functionality. Net: a legitimate patch-soon priority for XML-signature-handling services, not a drop-everything event. Also note the input 'Authentication Bypass' tag conflicts with the DoS nature of this CVE and appears mislabeled.

An attacker sends a specially crafted signed or encrypted XML document (e.g. a SAML assertion, WS-Security message, or XML DSig payload) to a .NET service that validates it using System.Security.Cryptography.Xml. The deeply nested structure triggers uncontrolled recursion, exhausting stack/CPU resources and crashing or hanging the worker process. No authentication or user interaction is required, and because the payload is static it can be scripted and replayed (SSVC Automatable=yes), though no public exploit code is known at time of analysis.