High

A critical vulnerability, CVE-2026-26127, has been disclosed in the .NET Framework, prompting an emergency security update from Microsoft. The flaw allows unauthenticated remote attackers to trigger a Denial-of-Service (DoS) condition over a network. With a CVSS score of high, Microsoft has classified the vulnerability as “Important.” The issue affects multiple .NET versions running on Windows, macOS, and Linux, making it relevant for a wide range of enterprise environments that rely on .NET-based applications.

The vulnerability stems from an out-of-bounds read weakness, categorized under CWE-125 Out-of-Bounds Read. This type of flaw occurs when a program reads memory outside the intended buffer boundaries either before the beginning or after the end of allocated memory. In the context of .NET applications, such improper memory handling can cause applications to crash, ultimately leading to service disruption. Attackers can exploit this issue by sending a specially crafted network request to a vulnerable .NET application, triggering the memory error and causing the system to terminate unexpectedly.

Despite the severity, Microsoft currently assesses the exploitability as “Unlikely.” While the attack requires low attack complexity and does not require user interaction or elevated privileges, there is currently no evidence of active exploitation in the wild or publicly available exploit code. However, the vulnerability details have been publicly disclosed by an anonymous researcher, which increases the risk that threat actors may attempt to reverse-engineer a functional exploit in the future.

The vulnerability affects .NET 9.0 and .NET 10.0 installations across Windows, macOS, and Linux, as well as the Microsoft.Bcl.Memory packages (versions 9.0 and 10.0). Microsoft has released patches to address the issue and recommends that organizations immediately update .NET 9.0 to version 9.0.14 and .NET 10.0 to version 10.0.4. Applications using the Microsoft.Bcl.Memory NuGet package should also upgrade to the patched versions. Additionally, administrators are advised to monitor system logs and network traffic for unexpected crashes or suspicious requests that may indicate attempted DoS exploitation. Applying these updates is essential to prevent service disruption and maintain the availability of critical .NET-based systems.