The vulnerability is an unchecked input used for a loop condition in the .NET runtime and development environment. Because the loop control value is not validated, an attacker can supply crafted data that causes the loop to run indefinitely, exhausting system resources and resulting in a denial of service for the application or service that receives the malicious input. The weakness maps to CWE‑606 (Unchecked Input for Loop Condition).

Affected are Microsoft products: .NET 10.0, .NET 9.0, .NET 8.0 and Microsoft Visual Studio 2022 version 17.14 as well as Visual Studio 2026 version 18.8. The problem exists in the core framework runtime and associated tooling that process external input used to control loop iterations.

The CVSS v3.1 score is 7.5, indicating high severity. The EPSS score of 1% suggests that exploitation is uncommon but possible; the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a remote network-based attacker sending malicious input to a component that uses loop conditions without validation, which can trigger the denial of service. Because the flaw requires only input manipulation, no additional privileges are needed on the target system.