CVE-2026-33116

Summary

Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.

Affected Software

VendorProductVersion RangeStatus
Microsoft.NET 10.010.0.0 < 10.0.6affected
Microsoft.NET 8.08.0 < 8.0.26affected
Microsoft.NET 8.08.0.0 < 8.0.26affected
Microsoft.NET 9.09.0.0 < 9.0.15affected
MicrosoftMicrosoft .NET Framework 3.53.5.0 < 2.0.50727.8982 & 3.0.30729.8976affected
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.24.7.0 < 2.0.50727.9068 & 3.0.30729.9065 & 4.7.4141.0affected
MicrosoftMicrosoft .NET Framework 3.5 AND 4.84.8.0 < 2.0.50727.9068 & 3.0.30729.9065 & 4.8.4801.0affected
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8.14.8.1 < 2.0.50727.9181 & 3.0.30729.9165 & 4.8.9332.0affected
MicrosoftMicrosoft .NET Framework 4.6.2/4.7/4.7.1/4.7.24.7.0 < 4.8.4801.0affected
MicrosoftMicrosoft .NET Framework 4.84.8.0 < 4.8.4801.0affected

Weaknesses

  • CWE-835: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
  • CWE-400: CWE-400: Uncontrolled Resource Consumption
  • CWE-20: CWE-20: Improper Input Validation

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform

Additional References

References