EUVD-2026-44392
GHSA-w7cw-xp7h-6j5j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed .NET endpoint
-
DeliverySend crafted mistyped input
-
ExploitBypass improper type validation
-
ExecutionTrigger unhandled error or resource exhaustion
-
PersistCrash or hang service
-
ImpactDenial of service for users
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Specified type validation
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over the network against a .NET application that processes attacker-supplied input through the affected type-validation path (CVSS AV:N/AC:L/PR:N/UI:N). The practical limiting factor is exposure: an affected .NET 8.0/9.0/10.0 runtime must be reachable and must actually parse/deserialize attacker-controlled input on the vulnerable code path, so services that never expose such an endpoint to untrusted networks are not realistically reachable. Impact is limited to availability (A:H, C:N/I:N) - no data compromise or code execution - and scope is unchanged (S:U). Despite the 'Authentication Bypass' tag in the source data, PR:N and the DoS description indicate authentication is not a prerequisite; the tag is unverified. |
| Impact | The signals are mostly consistent and point to a moderate-priority DoS rather than a critical breach: the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a network-reachable, low-complexity, unauthenticated attack with no user interaction, but the impact is confined to availability - no data disclosure or code execution. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation or automated weaponization; the realistic risk is service disruption of internet-facing .NET applications. One notable data conflict must be flagged: the input Tags include 'Authentication Bypass,' yet the CVSS vector shows C:N/I:N and PR:N and the description explicitly says 'deny service.' The tag appears to be mislabeled/auto-generated and is not supported by the vector or description - treat this strictly as a denial-of-service issue and verify with the Microsoft advisory before assuming any auth-bypass behavior. Absent EPSS/KEV data, prioritize based on internet exposure of .NET-hosted services. |
| Exploit ScenarioDerived | An attacker sends a specially crafted network request containing input whose type or structure is not properly validated to a public-facing ASP.NET Core service running an affected .NET version. The malformed input reaches the vulnerable parsing path, throws an unhandled error or exhausts resources, and crashes or hangs the worker process, taking the service offline for legitimate users. The low attack complexity and lack of authentication or user interaction make repeated disruption straightforward, though no public exploit code has been identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Remote denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows an unauthenticated network attacker to crash or hang the runtime by sending crafted input that fails proper type validation (CWE-1287). The flaw carries a CVSS 7.5 rating driven entirely by availability impact (A:H) with no confidentiality or integrity loss, and no public exploit has been identified at time of analysis. Microsoft has released a patch; there is no indication of active exploitation.
RemediationAI
Patch available per vendor advisory: apply the Microsoft update for the affected .NET release train (8.0, 9.0, or 10.0) and update Visual Studio 2022 (17.12/17.14) and Visual Studio 2026 (18.7) to their patched builds as listed in the MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50524; exact fixed version numbers are not included in the provided data and should be taken from that advisory. Because self-contained deployments bundle the runtime, rebuild and redeploy those applications with the patched SDK rather than relying only on machine-wide runtime updates. Until patching is complete, reduce exposure of internet-facing .NET/ASP.NET Core endpoints by placing them behind a reverse proxy or WAF that validates request structure and size, applying rate limiting to blunt repeated crash attempts, and restricting network access to trusted clients where feasible - noting these controls reduce but do not eliminate the DoS risk and may affect legitimate traffic if tuned too aggressively.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 18 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Microsoft .NET runtime and its associated tooling (the CPE data confirms .NET 8.0, 9.0, and 10.0, plus Visual Studio 2022 versions 17.12/17.14 and Visual Studio 2026 version 18.7, which bundle the affected SDK/runtime). The root cause is classified as CWE-1287, Improper Validation of Specified Type of Input, meaning the runtime accepts data whose declared or assumed type does not match its actual structure and fails to reject it safely. When such malformed/mistyped input reaches a vulnerable parsing or deserialization path, it drives the process into an unhandled error state or resource exhaustion, terminating availability. Because .NET underpins ASP.NET Core web services and networked applications, the parsing path is reachable over the network, consistent with the AV:N vector.
Know when Net 10 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, low-complexity, unauthenticated input-validation DoS with no user interaction; impact limited to availability, so C:N/I:N/A:H and S:U.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.
Executive ViewAI
Any organization running Microsoft .NET versions 8.0, 9.0, or 10.0 faces a high risk of application downtime from remote network-based attacks. An available patch from Microsoft should be prioritized to restore risk to acceptable levels and ensure continued service availability.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB