An unreachable exit condition creates an infinite loop in .NET, .NET Framework and Visual Studio code paths. The constantly spinning loop consumes CPU resources, rendering the affected application or service unresponsive and effectively denying service to legitimate users. The weakness is identified as improper input handling (CWE-20), resource exhaustion (CWE-400), infinite loop (CWE-835), and improper data flow (CWE-776).

Microsoft .NET 10.0, .NET 9.0, .NET 8.0, .NET Framework 3.5, .NET Framework 3.5 with 4.7.2, .NET Framework 4.6.2/4.7/4.7.1/4.7.2, .NET Framework 4.8, and associated Visual Studio products are potentially impacted, but only the product names are listed; specific affected sub‑versions were not supplied.

The CVSS score of 7.5 denotes a high risk level, and no EPSS data is available. The vulnerability is not currently in the CISA KEV catalog. The primary attack vector is over the network, where an unauthenticated attacker can trigger the vulnerable code path to induce the infinite loop. Successful exploitation will lead to resource exhaustion and denial of service for authorized users. Because the vulnerability can be triggered remotely without requiring privileged credentials, the likelihood of exploitation remains significant until a patch is applied.