# CVE-2026-32203: Microsoft .NET and Visual Studio stack overflow denial of service

Source: https://junglewise.ai/threats/cve-2026-32203-microsoft-net-and-visual-studio-stack-overflow-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-32203 · Severity: high · CVSS 7.5 · Published 2026-04-14

A security vulnerability has been identified in a Microsoft .NET component used for processing encrypted XML data. An attacker could exploit this flaw to crash applications that use this library, leading to a denial of service. This could disrupt business operations and service availability for any software relying on these specific .NET versions.

Technologies: [Microsoft Visual Studio](https://junglewise.ai/threats/technologies/visual-studio), [System.Security.Cryptography.Xml (NuGet)](https://junglewise.ai/threats/technologies/system-security-cryptography-xml), [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [NuGet](https://junglewise.ai/threats/vendors/nuget), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-32203 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32203 being exploited in the wild.

**How severe is CVE-2026-32203?** High severity, with a CVSS score of 7.5, published 14 April 2026.

**Which products and versions are affected?** Microsoft Visual Studio Not specified; System.Security.Cryptography.Xml (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.6; Red Hat Enterprise Linux AppStream 8, 9, 10.0, 10.1.

**Is there a fix for CVE-2026-32203?** Yes. System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32203 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-32203?** Check whether you run Microsoft Visual Studio, System.Security.Cryptography.Xml (NuGet) or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.6 or later

  ```sh
  dotnet add package System.Security.Cryptography.Xml --version 10.0.6
  ```


## Technical details

A stack-based buffer overflow (CWE-121) exists in the EncryptedXml class within the System.Security.Cryptography.Xml package. The vulnerability is caused by improper input validation (CWE-20) when processing specially crafted XML content. A remote, unauthenticated attacker can exploit this over the network without user interaction to cause a denial of service (DoS) by crashing the application process. The issue affects .NET 8, 9, and 10. Patches are available in versions 8.0.3, 9.0.15, and 10.0.6 respectively.

## Affected products

- Microsoft System.Security.Cryptography.Xml 8.0.0 - 8.0.2, 9.0.0 - 9.0.14, 10.0.0 - 10.0.5

## Identifiers

- CVE-2026-32203
- GHSA-6588-8gv4-xfgh

## Timeline

- 2026-04-14: disclosed: Initial advisory publication
- 2026-04-14: patched: Patched versions released for .NET 8, 9, and 10
- 2026-07-28: advisory: GitHub Advisory updated

## References

- [https://github.com/dotnet/runtime/security/advisories/GHSA-6588-8gv4-xfgh](https://github.com/dotnet/runtime/security/advisories/GHSA-6588-8gv4-xfgh)
- [https://github.com/dotnet/runtime/issues/126891](https://github.com/dotnet/runtime/issues/126891)
- [https://github.com/dotnet/announcements/issues/391](https://github.com/dotnet/announcements/issues/391)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32203.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32203.json)
- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32203](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32203)

## Related threats

- [Microsoft Visual Studio heap buffer overflow RCE](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-224be73b)
- [Microsoft Visual Studio heap-based buffer overflow](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-6a4b9d28)
- [Microsoft Visual Studio deserialization remote code execution](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-1eb2f932)
- [Microsoft Visual Studio stack-based buffer overflow](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-d956164d)
- [Microsoft Visual Studio heap buffer overflow RCE](https://junglewise.ai/threats/cve-2026-118745-heap-based-buffer-overflow-in-visual-studio-allows-an)