Executive brief
A security vulnerability has been identified in a Microsoft .NET component used for processing encrypted XML data. An attacker could send specially crafted data to an application, causing it to consume excessive system resources and become unresponsive. This could lead to a service outage, preventing legitimate users from accessing the application.
Technical details
A denial of service vulnerability exists in the EncryptedXml implementation within the System.Security.Cryptography.Xml package. The root cause is a failure to properly limit or throttle resource allocation (CWE-770) when processing maliciously crafted encrypted XML documents. A remote, unauthenticated attacker can exploit this over the network by submitting a crafted payload that triggers uncontrolled resource consumption. This affects .NET 8, .NET 9, and .NET 10. Patches are available in versions 8.0.29, 9.0.18, and 10.0.10.
Affected products
- Microsoft System.Security.Cryptography.Xml >= 8.0.0, <= 8.0.28; >= 9.0.0, <= 9.0.17; >= 10.0.0, <= 10.0.9
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory
- 2026-07-20: other: GitHub Advisory published
References
- https://github.com/dotnet/runtime/security/advisories/GHSA-23rf-6693-g89p
- https://github.com/dotnet/announcements/issues/419
- https://github.com/dotnet/runtime/issues/130714
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50648
- https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-23rf-6693-g89p