Microsoft UFO is an open‑source automation framework that provides an HTTP API. In versions prior to 3.0.9, the /api/task_result/{task_name} endpoint obtains a non‑reentrant lock and then re‑acquires the same lock when the task name maps to a session. This double locking can cause a deadlock. An authenticated user who knows or can create a mapped task name can trigger this deadlock, causing the server’s single‑process event loop to block indefinitely, preventing other HTTP, WebSocket, and background activities. The vulnerability affects only known task names; unknown names do not hit the nested call and are unaffected. The flaw results in a denial‑of‑service condition for the server.

Microsoft UFO version 3.0.8 and earlier are affected. The issue is resolved in release 3.0.9. The vulnerability applies to any deployment of Microsoft UFO where the default single‑process server configuration is used. All authenticated users who have access to the /api/task_result endpoint can potentially exploit the flaw. The CVE reference lists the affected product as Microsoft UFO.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score is not available, suggesting no publicly known exploit. The vulnerability is not listed in the CISA KEV catalog. An attacker would need authenticated access to the API and knowledge of a session‑related task name. Because the bug deadlocks the single‑process event loop, it can be leveraged to create a denial of service affecting all traffic to the instance. The lack of a public exploit and reliance on authenticated access reduce the likelihood of widespread exploitation, but the impact on availability makes it a concern for systems that rely on continuous automation.