EUVD-2026-22591
GHSA-6588-8gv4-xfgh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
6DescriptionCVE.org
Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
AnalysisAI
Denial of service via stack buffer overflow in .NET (versions 8.0, 9.0, 10.0) and Visual Studio 2022 (versions 17.12, 17.14) allows unauthenticated remote attackers to crash affected applications over the network. The vulnerability has a CVSS score of 7.5 (High) with low attack complexity and no privileges required. Vendor-released patches are available from Microsoft (MSRC). No public exploit identified at time of analysis, and the issue is not confirmed actively exploited.
Technical ContextAI
This vulnerability stems from a classic stack-based buffer overflow (CWE-121) in the .NET runtime and Visual Studio 2022 development environment. Stack buffer overflows occur when a program writes more data to a buffer on the call stack than allocated, potentially overwriting adjacent memory including return addresses and function pointers. In this case, the overflow triggers availability impact only (CVSS A:H with C:N/I:N), suggesting the flaw causes application crashes rather than enabling code execution. The affected components span multiple major .NET releases (8.0, 9.0, 10.0) and two Visual Studio 2022 update channels (17.12, 17.14), indicating the vulnerable code exists in shared runtime components or parsing libraries used across the Microsoft development stack. The network attack vector (AV:N) suggests the overflow is triggered by processing malformed network input, potentially in HTTP request handling, serialization/deserialization routines, or protocol parsers within the .NET framework.
RemediationAI
Vendor-released patches are available from Microsoft Security Response Center. Upgrade .NET 8.0 installations to version 8.0.26 or later, .NET 9.0 to version 9.0.15 or later, and .NET 10.0 to version 10.0.6 or later. For development environments, update Visual Studio 2022 version 17.12 to 17.12.19 or later, and version 17.14 to 17.14.30 or later. Apply updates through Microsoft Update, Visual Studio Installer, or download from the official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32203. Prioritize patching internet-facing .NET applications and production runtime environments first, followed by development and build systems. No effective workarounds are documented; patching is the primary mitigation strategy.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today