A race condition in the .NET Framework’s handling of concurrent execution with a shared resource can be triggered by an unauthorized attacker, causing a denial of service. The flaw stems from improper synchronization and is categorized as CWE‑362 and CWE‑821. This flaw can lead to application stalls or crashes, making the service unavailable to legitimate users.

Microsoft .NET Framework versions 3.5, 4.7.2, 4.8 and 4.8.1 are affected. Any application built on these runtimes and deployed on Windows systems may be vulnerable if the vulnerable framework is present.

This vulnerability has a CVSS score of 5.9, placing it in the moderate severity range. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, indicating no known widespread exploits yet. The likely attack vector is over a network, where a remote attacker could send crafted requests to trigger the race condition. Successful exploitation would result in a denial of service for actual users of the affected application.