DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-50525: CVE-2026-50525: Denial of Service Vulnerability in Microsoft .NET XML Cryptography Stack

#security #cve #cybersecurity

CVE-2026-50525: Denial of Service Vulnerability in Microsoft .NET XML Cryptography Stack

Vulnerability ID: CVE-2026-50525
CVSS Score: 7.5
Published: 2026-07-20

CVE-2026-50525 is a high-severity Denial of Service (DoS) vulnerability in the Microsoft .NET XML Cryptography stack. The vulnerability resides in the System.Security.Cryptography.Xml library, specifically within the EncryptedXml processing engine. Unauthenticated remote attackers can exploit this flaw by sending specifically crafted XML documents containing nested or recursive structures, or utilizing resource-intensive transforms. Processing such payloads leads to infinite CPU loops, stack exhaustion, or memory starvation, resulting in application termination.

TL;DR

A Denial of Service vulnerability in Microsoft .NET allows unauthenticated remote attackers to crash applications by submitting XML payloads containing deeply nested cryptographic elements or infinite XSLT loops.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-770
  • Attack Vector: Network
  • CVSS v3.1 Score: 7.5 (High)
  • Exploit Maturity: Proof of Concept
  • Impact: Denial of Service (DoS)
  • KEV Status: Not Listed

Affected Systems

  • Microsoft .NET 10.0
  • Microsoft .NET 9.0
  • Microsoft .NET 8.0
  • Microsoft .NET Framework 3.5
  • Microsoft .NET Framework 4.6.2
  • Microsoft .NET Framework 4.7
  • Microsoft .NET Framework 4.7.1
  • Microsoft .NET Framework 4.7.2
  • Microsoft .NET Framework 4.8
  • Microsoft .NET Framework 4.8.1
  • Microsoft Visual Studio 2022 v17.12
  • Microsoft Visual Studio 2022 v17.14
  • Microsoft Visual Studio 2026 v18.7
  • .NET: >= 10.0.0, < 10.0.6 (Fixed in: 10.0.6)
  • .NET: >= 9.0.0, < 9.0.18 (Fixed in: 9.0.18)
  • .NET: >= 8.0.0, < 8.0.29 (Fixed in: 8.0.29)

Code Analysis

Commit: 9db47f0

Restrict transforms in EncryptedXml and enforce DangerousMaxRecursionDepth in CanonicalizationDispatcher

In CanonicalizationDispatcher.cs and EncryptedType.cs, tracking thread-static integers to restrict deep XML structures during parse time, and whitelisting trusted algorithms to reject custom XSLT / XPath schemas.
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade .NET Framework and .NET Core runtime hosting environments to the latest patched security baselines.
  • Update application dependencies for System.Security.Cryptography.Xml to version 8.0.1 or higher.
  • Enforce strict input file size and nesting limits on API endpoints that process incoming XML formats.
  • Deploy WAF rules to detect and reject XML documents containing embedded XSLT transformations or complex XPath patterns.

Remediation Steps:

  1. Identify all production servers running vulnerable versions of .NET (8.0, 9.0, 10.0, and .NET Framework).
  2. Apply the July 2026 Microsoft Security Update to the server OS or upgrade .NET runtimes.
  3. Verify that the System.Security.Cryptography.Xml.AllowDangerousEncryptedXmlTransforms AppContext switch is set to false in production settings.
  4. Optionally set System.Security.Cryptography.Xml.DangerousMaxRecursionDepth to a restrictive value (e.g. 16 or 32) in runtimeconfig.json for enhanced validation.

References

Read the full report for CVE-2026-50525 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)