The vulnerability is an uncontrolled recursion flaw in the .NET runtime that allows malicious input to cause an excessive call stack, leading to a crash or resource exhaustion. Attackers able to send crafted requests over the network can trigger the recursion without needing authentication. The flaw falls under CWE-674, indicating that the recursive logic was not bounded correctly, resulting in a denial of service with potential interruption of available services and loss of availability for applications relying on .NET.

Microsoft publishes the flaw across a wide range of product releases, including .NET 10.0, .NET 11.0, .NET 8.0, .NET 9.0, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 3.5 AND 4.8.1, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.8, Microsoft .NET Framework 4.8.1, Visual Studio 2022 version 17.14, and Visual Studio 2026 version 18.10. All fourteen listed product lines are impacted as the same recursive logic exists in each release.

The CVSS score of 7.5 categorizes the risk as high, and the EPSS score of 1% indicates a small but non-zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so no confirmed exploits are known. It can be exploited remotely by an attacker that does not need privileges, by sending a specially crafted payload that triggers the unbounded recursion, possibly causing an application or service crash and a denial of service.