CVE-2026-50527

.NET Framework Denial of Service Vulnerability

Published Jul 14, 2026 CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Description

Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.

Analysis

Technical impact

A stack-based buffer overflow in the Microsoft .NET Framework can be triggered by an attacker sending specially crafted data over a network. The flaw, identified as CWE‑120 and CWE‑121, allows the attacker to corrupt stack memory and crash the affected component. The resulting crash causes a denial of service for any application or service that relies on the .NET runtime, but no data is disclosed or modified.

Affected Systems

This vulnerability affects Microsoft .NET Framework releases from 3.5 through 4.8.1, as well as the newer 8.0, 9.0, and 10.0 runtimes. It also impacts Visual Studio 2022 build 17.12 and 17.14, and Visual Studio 2026 build 18.7. All installations of these products on any operating system are potentially vulnerable unless the fix has been applied.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, but the EPSS score of < 1% suggests a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploits. Based on the description, it is inferred that the attack vector is remote over a network, requiring an attacker to send malformed input to a vulnerable .NET component. Successful exploitation would cause a crash and deny service to dependent processes, without affecting confidentiality or integrity.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

.NET 10.0 runtime

affected

Version	Status	Constraints
`10.0.0`	affected	< 10.0.10

Microsoft

.NET 8.0 runtime

affected

Version	Status	Constraints
`8.0.0`	affected	< 8.0.29

Microsoft

.NET 9.0 runtime

affected

Version	Status	Constraints
`9.0.0`	affected	< 9.0.18

Microsoft

Microsoft .NET Framework 3.5

affected

Version	Status	Constraints
`3.5.0`	affected	< 2.0.50727.8983 & 3.0.30729.8978

Microsoft

Microsoft .NET Framework 3.5 AND 4.7.2

affected

Version	Status	Constraints
`4.7.0`	affected	< 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0

Microsoft

Microsoft .NET Framework 3.5 AND 4.8

affected

Version	Status	Constraints
`4.8.0`	affected	< 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0

Microsoft

Microsoft .NET Framework 3.5 AND 4.8.1

affected

Version	Status	Constraints
`4.8.1`	affected	< 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0

Microsoft

Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2

affected

Version	Status	Constraints
`4.7.0`	affected	< 4.7.4143.0

Microsoft

Microsoft .NET Framework 4.8

affected

Version	Status	Constraints
`4.8.0`	affected	< 4.8.4803.0

Microsoft

Microsoft Visual Studio 2022 version 17.12

affected

Version	Status	Constraints
`17.12.0`	affected	< 17.12.22

Microsoft

Microsoft Visual Studio 2022 version 17.14

affected

Version	Status	Constraints
`17.14.0`	affected	< 17.14.36

Microsoft

Microsoft Visual Studio 2026 version 18.7

affected

Version	Status	Constraints
`18.0`	affected	< 18.7.4

Configuration 1 [-]

AND

cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_10_1607:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_1607:-::::::x86:
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:-:::::::*

Configuration 2 [-]

AND

OR	cpe:2.3:a:microsoft:.net_framework:4.6.2:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.7:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.7.1:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.7.2:::::::*

OR	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*

Configuration 3 [-]

AND

OR	cpe:2.3:a:microsoft:.net_framework:3.5:-::::::
	cpe:2.3:a:microsoft:.net_framework:4.8.1:::::::*

OR	cpe:2.3:o:microsoft:windows_10_21h2:-::::::arm64:
	cpe:2.3:o:microsoft:windows_10_21h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_21h2:-::::::x86:
	cpe:2.3:o:microsoft:windows_10_22h2:-::::::arm64:
	cpe:2.3:o:microsoft:windows_10_22h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_22h2:-::::::x86:
	cpe:2.3:o:microsoft:windows_11_23h2:-::::::arm64:
	cpe:2.3:o:microsoft:windows_11_23h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_11_24h2:-::::::arm64:
	cpe:2.3:o:microsoft:windows_11_24h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_11_25h2:-::::::arm64:
	cpe:2.3:o:microsoft:windows_11_25h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_11_26h1:-::::::arm64:
	cpe:2.3:o:microsoft:windows_11_26h1:-::::::x64:
	cpe:2.3:o:microsoft:windows_server_2022:-:::::::*

Configuration 4 [-]

AND

OR	cpe:2.3:a:microsoft:.net_framework:3.5:-::::::
	cpe:2.3:a:microsoft:.net_framework:4.8:::::::*

OR	cpe:2.3:o:microsoft:windows_10_1809:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_1809:-::::::x86:
	cpe:2.3:o:microsoft:windows_10_21h2:-::::::arm64:
	cpe:2.3:o:microsoft:windows_10_21h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_21h2:-::::::x86:
	cpe:2.3:o:microsoft:windows_10_22h2:-::::::arm64:
	cpe:2.3:o:microsoft:windows_10_22h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_22h2:-::::::x86:
	cpe:2.3:o:microsoft:windows_server_2019:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2022:-:::::::*

Configuration 5 [-]

AND

OR	cpe:2.3:a:microsoft:.net_framework:3.5:-::::::
	cpe:2.3:a:microsoft:.net_framework:4.7.2:::::::*

OR	cpe:2.3:o:microsoft:windows_10_1607:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_1607:-::::::x86:
	cpe:2.3:o:microsoft:windows_10_1809:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_1809:-::::::x86:
	cpe:2.3:o:microsoft:windows_server_2016:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2019:-:::::::*

Configuration 6 [-]

AND

cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*

Configuration 7 [-]

AND

OR	cpe:2.3:a:microsoft:.net::::::::
	cpe:2.3:a:microsoft:.net::::::::

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

Configuration 8 [-]

AND

cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*

Configuration 9 [-]

OR	cpe:2.3:a:microsoft:visual_studio_2022::::::::
	cpe:2.3:a:microsoft:visual_studio_2022::::::::
	cpe:2.3:a:microsoft:visual_studio_2026::::::::

Package	CPE	Advisory	Released Date
Red Hat Hardened Images
dotnet10-0-main-10.0.109-1.hum1	cpe:/a:redhat:hummingbird:1	RHSA-2026:26638	2026-06-17T00:00:00Z
dotnet9-0-main-9.0.118-1.hum1	cpe:/a:redhat:hummingbird:1	RHSA-2026:27171	2026-06-19T00:00:00Z

Vendor Product Versions

Microsoft

.net

Version	Status	Scheme	Platform
`—`	affected	—	—

Microsoft

.net

Version	Status	Scheme	Platform
`[10.0.0,10.0.6)`	affected	semver	—

Microsoft

.net

Version	Status	Scheme	Platform
`[8.0.0,8.0.29)`	affected	semver	—

Microsoft

.net

Version	Status	Scheme	Platform
`[9.0.0,9.0.18)`	affected	semver	—

Microsoft

.net Framework

Version	Status	Scheme	Platform
`3.5.0 lessThan: 2.0.50727.8983 & 3.0.30729.8978`	affected	generic	['windows_server_2012', 'windows_server_2012_(server_core_installation)', 'windows_server_2012_r2', 'windows_server_2012_r2_(server_core_installation)']

Microsoft

.net Framework

Version	Status	Scheme	Platform
`4.7.0 lessThan: 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0`	affected	generic	['windows_10_version_1607_for_32-bit_systems', 'windows_10_version_1607_for_x64-based_systems', 'windows_10_version_1809_for_32-bit_systems', 'windows_10_version_1809_for_x64-based_systems', 'windows_server_2016', 'windows_server_2016_(server_core_installation)', 'windows_server_2019', 'windows_server_2019_(server_core_installation)']

Microsoft

.net Framework

Version	Status	Scheme	Platform
`4.8.0 lessThan: 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0`	affected	generic	['windows_10_version_1809_for_32-bit_systems', 'windows_10_version_1809_for_x64-based_systems', 'windows_10_version_21h2_for_32-bit_systems', 'windows_10_version_21h2_for_arm64-based_systems', 'windows_10_version_21h2_for_x64-based_systems', 'windows_10_version_22h2_for_32-bit_systems', 'windows_10_version_22h2_for_arm64-based_systems', 'windows_10_version_22h2_for_x64-based_systems', 'windows_server_2019', 'windows_server_2019_(server_core_installation)', 'windows_server_2022', 'windows_server_2022_(server_core_installation)']

Microsoft

.net Framework

Version	Status	Scheme	Platform
`4.8.1 lessThan: 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0`	affected	generic	['windows_10_version_21h2_for_32-bit_systems', 'windows_10_version_21h2_for_arm64-based_systems', 'windows_10_version_21h2_for_x64-based_systems', 'windows_10_version_22h2_for_32-bit_systems', 'windows_10_version_22h2_for_arm64-based_systems', 'windows_10_version_22h2_for_x64-based_systems', 'windows_11_version_23h2_for_arm64-based_systems', 'windows_11_version_23h2_for_x64-based_systems', 'windows_11_version_24h2_for_arm64-based_systems', 'windows_11_version_24h2_for_x64-based_systems', 'windows_11_version_25h2_for_arm64-based_systems', 'windows_11_version_25h2_for_x64-based_system', 'windows_11_version_26h1_for_arm64-based_systems', 'windows_11_version_26h1_for_x64-based_systems', 'windows_server_2022', 'windows_server_2022_(server_core_installation)', 'windows_server_2025', 'windows_server_2025_(server_core_installation)']

Microsoft

.net Framework

Version	Status	Scheme	Platform
`4.7.0 lessThan: 4.7.4143.0`	affected	generic	['windows_server_2012', 'windows_server_2012_(server_core_installation)', 'windows_server_2012_r2', 'windows_server_2012_r2_(server_core_installation)']

Microsoft

.net Framework

Version	Status	Scheme	Platform
`4.8.0 lessThan: 4.8.4803.0`	affected	generic	['windows_10_version_1607_for_32-bit_systems', 'windows_10_version_1607_for_x64-based_systems', 'windows_server_2012', 'windows_server_2012_(server_core_installation)', 'windows_server_2012_r2', 'windows_server_2012_r2_(server_core_installation)', 'windows_server_2016', 'windows_server_2016_(server_core_installation)']

Microsoft

Microsoft Visual Studio 2022

Version	Status	Scheme	Platform
`[17.12.0,17.12.22)`	affected	semver	—

Microsoft

Microsoft Visual Studio 2022

Version	Status	Scheme	Platform
`[17.14.0,17.14.36)`	affected	semver	—

Microsoft

Microsoft Visual Studio 2022

Version	Status	Scheme	Platform
`[18.0,18.7.4)`	affected	semver	—

Microsoft

Visual Studio 2022

Version	Status	Scheme	Platform
`—`	affected	—	—

Microsoft

Visual Studio 2026

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Microsoft security update that addresses CVE‑2026‑50527 from the Microsoft Security Response Center update guide.
Upgrade all affected .NET Framework installations to the latest supported version (10.0, 9.0, 8.0 or newer) and ensure Visual Studio 2022 and 2026 builds are updated to the most recent release that contains the fix.
Restart any services or applications that depend on the .NET runtime so the patch takes effect.
Limit network exposure of applications that use the vulnerable .NET runtime by implementing firewall or segmentation rules.
Monitor system logs and performance for signs of crashes or denial-of-service events after the patch is applied.

Generated by OpenCVE AI on July 31, 2026 at 05:30 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-mmjf-rqrv-855v	Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability
Ubuntu USN	USN-8553-1	.NET vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.2% (1.174% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50527
https://nvd.nist.gov/vuln/detail/CVE-2026-50527
https://www.cve.org/CVERecord?id=CVE-2026-50527

History

Aug 5, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Microsoft .net Framework Microsoft microsoft Visual Studio 2022
Vendors & Products		Microsoft .net Framework Microsoft microsoft Visual Studio 2022

Jul 18, 2026 12:15 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat hummingbird
Weaknesses		CWE-120
CPEs		cpe:/a:redhat:hummingbird:1
Vendors & Products		Redhat Redhat hummingbird
References		https://nvd.nist.gov/vuln/detail/CVE-2026-50527 https://www.cve.org/CVERecord?id=CVE-2026-50527
Metrics	threat_severity `None`	threat_severity `Important`

Jul 14, 2026 10:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 7:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.
Title		.NET Framework Denial of Service Vulnerability
First Time appeared		Microsoft Microsoft .net Microsoft visual Studio 2022 Microsoft visual Studio 2026
Weaknesses		CWE-121
CPEs		cpe:2.3:a:microsoft:.net:::::::: cpe:2.3:a:microsoft:visual_studio_2022:::::::: cpe:2.3:a:microsoft:visual_studio_2026::::::::
Vendors & Products		Microsoft Microsoft .net Microsoft visual Studio 2022 Microsoft visual Studio 2026
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50527
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}`

Subscriptions

Apple Macos

Linux Linux Kernel

Microsoft .net .net Framework Microsoft Visual Studio 2022 Visual Studio 2022 Visual Studio 2026 Windows Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022

Redhat Hummingbird

Weaknesses