The vulnerability is caused by inefficient algorithmic complexity in the .NET framework, enabling an unauthenticated attacker to trigger a denial of service condition over a network by causing excessive resource consumption. The weakness is classified as CWE‑407, indicating uncontrolled resource consumption or improper optimization that can be abused for DoS attacks.

Microsoft .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and 4.8.1; Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.10; System.Security.Cryptography.Pkcs components are also affected.

The CVSS score of 7.5 classifies this flaw as High severity. The EPSS score is unavailable, but the flaw is not listed in the CISA KEV catalog, suggesting that there is no current evidence of widespread exploitation. Based on the description, the likely attack vector is remote network access, where an unauthenticated attacker sends crafted traffic to a vulnerable service to exhaust system resources.