An inefficiency in the algorithmic complexity of Microsoft .NET components permits an unauthorized actor to trigger excessive resource consumption, thereby rendering services unavailable. The weakness is classified as CWE‑407 and directly affects application availability, potentially causing service outages for end users.

Microsoft .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, 4.8.1 and System.Security.Cryptography.Xml components are all listed as affected. The vulnerability spans many distributed releases, so any application built on these frameworks without patching could be impacted.

The CVSS score of 7.5 indicates a substantial threat to availability; the EPSS score of 0.01056, and the flaw is not listed in the CISA KEV catalog. It is inferred that the attack can be launched over a network by an unauthenticated attacker who sends specially crafted requests that trigger the high‑complexity routine. The result is prolonged service disruption until the host resources are exhausted or the application must be restarted.