EUVD-2026-22363Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
6DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network.
AnalysisAI
Denial of service in Microsoft .NET Framework 3.5 through 4.8.1 allows unauthenticated remote attackers to crash applications via race condition exploitation over a network. The vulnerability stems from improper synchronization when multiple threads access shared resources concurrently (CWE-755). Affected versions span .NET Framework 3.5, 4.6.2, 4.7.x, 4.8, and 4.8.1 across multiple component combinations. Microsoft has released patches addressing the flaw. No public exploit code or active explo
Technical ContextAI
This vulnerability exploits a race condition (CWE-755) in the .NET Framework runtime's handling of concurrent thread execution accessing shared resources without proper synchronization primitives (locks, semaphores, or atomic operations). The flaw affects the core framework components across multiple major versions: .NET Framework 3.5 (CLR 2.0.50727.x and 3.0.30729.x components), 4.6.2 through 4.7.2 (CLR 4.7.x), 4.8 (CLR 4.8.4801.0), and 4.8.1 (CLR 4.8.9332.0). Race conditions in managed runtime environments are particularly critical because the .NET Framework serves as the execution engine for countless Windows applications and services. The shared resource contention likely occurs in native interop layers, thread pool management, or memory allocation subsystems where timing-dependent execution order can lead to inconsistent state. Applications built on any affected .NET Framework version inherit this vulnerability regardless of their own code quality.
RemediationAI
Apply vendor-released patches immediately from Microsoft Update or Windows Server Update Services (WSUS). For .NET Framework 3.5, upgrade components to at least 2.0.50727.8982 and 3.0.30729.8976. For combined 3.5 and 4.7.2 installations, upgrade to 2.0.50727.9068, 3.0.30729.9065, and 4.7.4141.0 or higher. For combined 3.5 and 4.8 installations, upgrade to 2.0.50727.9068, 3.0.30729.9065, and 4.8.4801.0 or higher. For combined 3.5 and 4.8.1 installations, upgrade to 2.0.50727.9181, 3.0.30729.9165, and 4.8.9332.0 or higher. For standalone 4.6.2 through 4.8 installations, upgrade to 4.8.4801.0 or later. Download patches directly from Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23666. No workarounds are documented; patching is the only effective mitigation. Test patches in non-production environments before deploying to critical systems, as framework updates may require application compatibility validation. Reboot systems after patch installation to ensure complete runtime replacement.
More in Microsoft Net Framework 3 5
View allInfinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Local code execution in Microsoft .NET (Framework 3.5 through 4.8.1, .NET 8.0/9.0, and Visual Studio 2022/2026) arises f
Local privilege elevation in Microsoft .NET Framework (and .NET 8.0/9.0 plus Visual Studio 2022/2026) via code injection
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) and the legacy .NET Framework (3.5 through 4.8.1) allo
Denial of service in Microsoft .NET (including .NET 8.0/9.0/10.0 and .NET Framework 3.5 through 4.8.1) lets a remote una
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) and .NET Framework (3.5 through 4.8.1) allows a remote
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today