An inefficient algorithmic design in Microsoft .NET allows an attacker who is not authenticated to cause a denial of service by exhausting system resources while the target is accessed over a network. The vulnerability directly impacts availability, enabling the attacker to disrupt application or system uptime, but does not compromise confidentiality or integrity.

Microsoft .NET 10.0, 11.0, 8.0, 9.0, Microsoft .NET Framework 3.5, and all 4.x releases (4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, 4.8.1), as well as Microsoft Visual Studio 2022 (17.14) and Microsoft Visual Studio 2026 (18.10).

The CVSS score of 7.5 indicates a high severity. The EPSS score is 1%, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote network connection that abuses the resource-heavy algorithm to drain system capacity. Proper exploitation would require the attacker to send crafted input or engage the vulnerable component, causing the process to consume excessive memory or CPU until service becomes unavailable.