CVE-2026-33116: Microsoft .NET infinite loop in XmlDecryptionTransform

CVE-2026-33116 · Severity: high · CVSS 7.5 · Published 2026-04-14

A vulnerability in Microsoft .NET and Visual Studio could allow an attacker to crash applications or make them unresponsive. This occurs when the software processes specifically crafted data, causing it to enter an infinite loop that consumes all available system resources. This can lead to a total service outage, preventing customers and employees from accessing affected web services or applications.

Technologies: Microsoft .NET Framework, Microsoft Visual Studio, System.Security.Cryptography.Xml (NuGet), Red Hat Enterprise Linux AppStream. Vendors: Microsoft, NuGet, Red Hat.

Quick answers

Is CVE-2026-33116 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33116 being exploited in the wild.
How severe is CVE-2026-33116?
High severity, with a CVSS score of 7.5, published 14 April 2026.
Which products and versions are affected?
System.Security.Cryptography.Xml (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.6; Red Hat Enterprise Linux AppStream 8, 9, 10.
Is there a fix for CVE-2026-33116?
Yes. System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33116 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33116?
Check whether you run Microsoft .NET Framework, Microsoft Visual Studio, System.Security.Cryptography.Xml (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.6 or later
    dotnet add package System.Security.Cryptography.Xml --version 10.0.6

Technical details

An infinite recursion vulnerability exists in the XmlDecryptionTransform component of .NET, .NET Framework, and Visual Studio. The flaw is triggered by improper restriction of recursive entity references in DTDs (XML Entity Expansion) or improper input validation during XML transformation. A remote, unauthenticated attacker can exploit this by sending a specially crafted XML payload to an application that uses the affected libraries. Successful exploitation leads to uncontrolled resource consumption (CPU/memory) and a subsequent denial-of-service (DoS) condition. Patches are available through Microsoft and Red Hat (e.g., .NET SDK 9.0.116 and 8.0.126).

Affected products

  • Microsoft .NET 8.0, 9.0
  • Microsoft .NET Framework
  • Microsoft Visual Studio
  • Red Hat Enterprise Linux AppStream 8, 9, 10

Identifiers

  • CVE-2026-33116
  • GHSA-37gx-xxp4-5rgx

Timeline

  • 2026-04-14: advisory: Initial disclosure by Microsoft and NVD.
  • 2026-05-04: patched: Red Hat released security updates for RHEL.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.