This vulnerability arises from asymmetric resource consumption in the .NET runtime, allowing an unauthenticated attacker to send crafted input that triggers disproportionate allocation of server resources. The resulting amplification can exhaust available CPU, memory, or other resources, causing a denial-of-service.

Microsoft .NET Framework versions 3.5, 4.6.2 through 4.8.1, as well as the System.Security.Cryptography.Xml library, are affected. Microsoft’s update guide lists these specific releases as vulnerable.

The CVSS score of 7.5 indicates a high severity of this denial-of-service flaw. The EPSS score of 1% indicates a very low but nonzero exploitation probability, and the vulnerability is not currently listed in the CISA KEV catalog. A remote attacker who can reach a vulnerable .NET application over the network can exploit this weakness without authentication, potentially overwhelming the service and making it unavailable to legitimate users.