An out‑of‑bounds write in ASP.NET Core enables an unauthorized network attacker to trigger a denial of service. The flaw can cause the framework to crash or enter an inconsistent state, which results in application unavailability. The attack requires the ability to send requests to the vulnerable service but does not depend on elevated privileges on the host.

Microsoft .NET (Core) versions 8.0, 9.0, 10.0, and 11.0, as well as Microsoft .NET Framework versions 3.5, 4.6.2 through 4.8.1 are listed as affected. The vulnerability applies to all installations of these runtimes that have not received the latest security update.

The CVSS score of 7.5 rates this issue as high severity. The EPSS score is not available, so it is unclear how frequently it has been exploited in production. It is not listed in the CISA KEV catalog, suggesting no widespread active exploitation is documented. An attacker who can reach the ASP.NET Core application over the network could leverage the out‑of‑bounds write to cause a crash or reset, thereby denying service. Network connectivity to the vulnerable endpoint and the presence of the unpatched ASP.NET Core code are the main prerequisites.