The vulnerability in the Microsoft .NET Framework allows an unauthorized attacker to continuously allocate system resources without any limits, leading to excessive consumption of memory or CPU. This resource exhaustion can render affected applications or services unavailable to legitimate users. The weakness is identified as a CWE-770, Allocation of Resources Without Limits or Throttling.

Affected systems include Microsoft .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, 4.8.1 and the System.Security.Cryptography.Xml component. Various product combinations are affected as indicated by the CNA advisory, covering many releases of the .NET Framework.

The severity score of 7.5 indicates a high potential for impact. Because the vulnerability can be triggered remotely via network requests and the EPSS score is not available, the current evidence suggests a realistic chance of exploitation in environments that expose vulnerable .NET applications over the internet. The flaw is not listed in CISA KEV, but the lack of such a designation does not diminish the risk profile. An attacker with network access could repeatedly invoke the vulnerable code to exhaust resources, resulting in a denial of service.