CVE-2026-23666 is a vulnerability in Microsoft .NET Framework 3.5 where improper input validation and synchronization lead to a race condition (CWE-366). This race condition allows an unauthenticated attacker to cause a denial of service by exploiting concurrent execution of shared resources without proper locking. The vulnerability affects availability (DoS) but does not compromise confidentiality or integrity. The issue has been assigned a CVSS v3.1 base score of 7.5 (high severity) with network attack vector, low complexity, no privileges required, and no user interaction. Microsoft has released an official fix for this vulnerability. The flaw also affects Red Hat Enterprise Linux 8, 9, and 10, as well as Fedora, where .NET Framework is deployed. No known exploits are reported in the wild at this time.

The vulnerability allows an unauthenticated attacker to cause a denial of service on affected systems by exploiting a race condition in .NET Framework 3.5. This results in system unavailability but does not impact data confidentiality or integrity. The impact is limited to availability disruption over a network.

An official fix is available from Microsoft for this vulnerability. Users and administrators should apply the provided security updates to Microsoft .NET Framework 3.5 as soon as possible to remediate the issue. No alternative mitigations are currently available or meet criteria for ease of use and applicability. Systems running affected versions should be updated to the fixed version to prevent denial of service attacks.