Junglewise Threat Intelligence

CVE-2026-33116: Microsoft .NET infinite loop in XmlDecryptionTransform

CVE-2026-33116 · Severity: high · CVSS 7.5 · Published 2026-04-14

Technologies: Red Hat Enterprise Linux AppStream, Microsoft .NET Framework, Microsoft Visual Studio. Vendors: Red Hat, Microsoft.

Executive brief

A vulnerability in Microsoft .NET and Visual Studio could allow an attacker to crash applications or make them unresponsive. This occurs when the software processes specifically crafted data, causing it to enter an infinite loop that consumes all available system resources. This can lead to a total service outage, preventing customers and employees from accessing affected web services or applications.

Technical details

An infinite recursion vulnerability exists in the XmlDecryptionTransform component of .NET, .NET Framework, and Visual Studio. The flaw is triggered by improper restriction of recursive entity references in DTDs (XML Entity Expansion) or improper input validation during XML transformation. A remote, unauthenticated attacker can exploit this by sending a specially crafted XML payload to an application that uses the affected libraries. Successful exploitation leads to uncontrolled resource consumption (CPU/memory) and a subsequent denial-of-service (DoS) condition. Patches are available through Microsoft and Red Hat (e.g., .NET SDK 9.0.116 and 8.0.126).

Affected products

  • Microsoft .NET 8.0, 9.0
  • Microsoft .NET Framework
  • Microsoft Visual Studio
  • Red Hat Enterprise Linux AppStream 8, 9, 10

Timeline

  • 2026-04-14: advisory: Initial disclosure by Microsoft and NVD.
  • 2026-05-04: patched: Red Hat released security updates for RHEL.

References

Related threats