Executive brief
A vulnerability in the Microsoft .NET Framework could allow an attacker to crash applications or services remotely. The .NET Framework is a widely used software platform for building and running Windows applications. An exploit could lead to a denial-of-service condition, disrupting business operations and making affected services unavailable to users.
Technical details
A denial-of-service vulnerability exists in the Microsoft .NET Framework due to improper input validation and a race condition (CWE-366) during concurrent execution using shared resources. The flaw is triggered when the framework improperly handles exceptional conditions (CWE-755) during network-based interactions. An unauthenticated attacker can exploit this over the network without user interaction to cause the affected application or service to become unresponsive or crash. Microsoft has released security updates to address this issue across various versions of .NET Framework on supported Windows and Windows Server platforms.
Affected products
- Microsoft .NET Framework 3.5 < 2.0.50727.8982 & 3.0.30729.8976
- Microsoft .NET Framework 4.7.2 < 4.7.4141.0
- Microsoft .NET Framework 4.8 < 4.8.4801.0
- Microsoft .NET Framework 4.8.1 All versions on affected Windows platforms
Timeline
- 2026-04-14: disclosed
- 2026-04-14: advisory