System.Security.Cryptography.Pkcs EUVD-2026-100402

Exploitable only against Windows-hosted .NET applications that reference a vulnerable System.Security.Cryptography.Pkcs version (>=8.0.0<=8.0.1, >=9.0.0<=9.0.20, >=10.0.0<=10.0.12, or 11.0.0-preview.1 through 11.0.0-rc.1) AND that pass attacker-controlled data to EnvelopedCms.Decode while processing PKCS#7/CMS enveloped messages. The attacker needs no authentication or user interaction and can reach it pre-auth over the network, but exploitation is LIMITED by: Windows platform only (the GHSA states non-Windows is not affected); the application must actually expose and invoke the CMS/PKCS#7 decode code path on untrusted input (many .NET web apps never do); and high attack complexity (AC:H) since the request payload must be specifically crafted to force quadratic resource consumption.

This is a moderate-severity denial-of-service issue (CVSS 5.9, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) with impact limited strictly to availability (A:H; C:N/I:N) - there is no code execution or data exposure. The signals are internally consistent and point AWAY from urgent priority: the network vector and lack of required privileges or user interaction (AV:N/PR:N/UI:N) are offset by high attack complexity (AC:H), reflecting that the attacker must craft CMS/PKCS#7 attributes that trigger quadratic processing in EnvelopedCms.Decode and the target app must actually invoke that decode path on untrusted input. CISA's SSVC framework reinforces a low-urgency posture: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The one tension to note: the generic NVD/MSRC description frames this as a broad '.NET web application' DoS via 'web requests,' while the authoritative dotnet/runtime GHSA advisory scopes it precisely to Windows-only applications that call EnvelopedCms.Decode on attacker-supplied PKCS#7/CMS data - a much narrower exposure than the description implies. Treat the GHSA scoping as authoritative. Net: a real but low-priority, patch-in-normal-cycle issue, not an emergency.

A .NET web application running on Windows exposes an endpoint that decodes attacker-supplied PKCS#7/CMS data (e.g. validating an uploaded signed/enveloped message) using a vulnerable System.Security.Cryptography.Pkcs version. A remote, unauthenticated attacker submits specially crafted CMS attributes that force EnvelopedCms.Decode into quadratic-time processing, exhausting CPU and degrading or halting the service before authentication. No public exploit code has been identified at time of analysis; attack complexity is high because the payload must be shaped to trigger the quadratic path and the app must actually reach the vulnerable decode call.