Is CVE-2026-96958 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96958 being exploited in the wild.

How severe is CVE-2026-96958?

High severity, with a CVSS score of 7.5, published 13 October 2026.

Which products and versions are affected?

Microsoft System.Private.Xml affected in .NET runtimes; Microsoft System.Security.Cryptography.Xml 8.0.0-8.0.4, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1; System.Security.Cryptography.Xml (NuGet) >= 10.0.0, <= 10.0.12, ECOSYSTEM:introduced=10.0.0,fixed=10.0.13.

How is CVE-2026-96958 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-96958?

Check whether you run Microsoft System.Private.Xml, Microsoft System.Security.Cryptography.Xml or System.Security.Cryptography.Xml (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96958: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Q: Is there a fix for CVE-2026-96958?

Yes. System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.13 or later. Until then: Install the latest .NET SDK or runtime version, or update the System.Security.Cryptography.Xml package reference to the patched version. Applications deployed as self-contained deployments must be recompiled and redeployed with the fixed package versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-96958 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-96958?

Check whether you run Microsoft System.Private.Xml, Microsoft System.Security.Cryptography.Xml or System.Security.Cryptography.Xml (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96958 · Severity: high · CVSS 7.5 · Published 2026-10-13

Microsoft's XML cryptography library has a flaw that allows attackers to cause a denial of service by crafting specially-formed signed XML documents that consume excessive CPU resources. Applications that process untrusted XML signatures are vulnerable to outages when handling these malicious inputs.

Technologies: Microsoft System.Security.Cryptography.Xml, System.Security.Cryptography.Xml (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-96958 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96958 being exploited in the wild.
How severe is CVE-2026-96958?: High severity, with a CVSS score of 7.5, published 13 October 2026.
Which products and versions are affected?: Microsoft System.Private.Xml affected in .NET runtimes; Microsoft System.Security.Cryptography.Xml 8.0.0-8.0.4, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1; System.Security.Cryptography.Xml (NuGet) >= 10.0.0, <= 10.0.12, ECOSYSTEM:introduced=10.0.0,fixed=10.0.13.
Is there a fix for CVE-2026-96958?: Yes. System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.13 or later. Until then: Install the latest .NET SDK or runtime version, or update the System.Security.Cryptography.Xml package reference to the patched version. Applications deployed as self-contained deployments must be recompiled and redeployed with the fixed package versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96958 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-96958?: Check whether you run Microsoft System.Private.Xml, Microsoft System.Security.Cryptography.Xml or System.Security.Cryptography.Xml (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.13 or later

dotnet add package System.Security.Cryptography.Xml --version 10.0.13

Install the latest .NET SDK or runtime version, or update the System.Security.Cryptography.Xml package reference to the patched version. Applications deployed as self-contained deployments must be recompiled and redeployed with the fixed package versions.

Technical details

The System.Security.Cryptography.Xml and System.Private.Xml libraries suffer from inefficient algorithmic complexity (CWE-407) in signed XML processing. An attacker can send a malicious XML document with excessive nesting depth, operation counts, or entity references that causes the parser to consume unbounded CPU and memory, leading to denial of service. Network-accessible .NET applications processing untrusted XML are vulnerable without authentication or user interaction required.

Affected products

Microsoft System.Security.Cryptography.Xml 8.0.0-8.0.4, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1
Microsoft System.Private.Xml affected in .NET runtimes

Identifiers

CVE-2026-96958
GHSA-r955-8q5j-3h83

Timeline

2026-10-13: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.