Executive brief
A security vulnerability has been identified in a Microsoft .NET component used for processing encrypted XML data. An attacker could exploit this flaw to crash an application or service, leading to a denial of service. This affects developers using .NET 8, 9, and 10 who utilize the System.Security.Cryptography.Xml package.
Technical details
A denial of service vulnerability exists in the EncryptedXml implementation within the System.Security.Cryptography.Xml package for .NET 8, 9, and 10. The issue is classified as a stack-based buffer overflow (CWE-121) resulting from improper validation of crafted encrypted XML input. An unauthenticated remote attacker can exploit this by providing malicious XML data, causing the application to crash. Microsoft has released patched versions of the NuGet package (8.0.29, 9.0.18, and 10.0.10) to address this flaw.
Affected products
- Microsoft System.Security.Cryptography.Xml >= 8.0.0, <= 8.0.28; >= 9.0.0, <= 9.0.17; >= 10.0.0, <= 10.0.9
Timeline
- 2026-07-14: disclosed
- 2026-07-14: patched
- 2026-07-21: advisory
References
- https://github.com/dotnet/runtime/security/advisories/GHSA-mmjf-rqrv-855v
- https://github.com/dotnet/announcements/issues/416
- https://github.com/dotnet/runtime/issues/130712
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50527
- https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-mmjf-rqrv-855v