This vulnerability (CVE-2026-33116) is classified as CWE-835 (Loop with Unreachable Exit Condition) and affects Microsoft .NET 10.0. It causes an infinite loop due to a loop construct that cannot exit under certain conditions, enabling an attacker to trigger a denial of service remotely without requiring privileges or user interaction. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

An attacker can exploit this vulnerability to cause a denial of service by triggering an infinite loop in the .NET 10.0 runtime environment. This results in resource exhaustion and service unavailability. There is no impact on confidentiality or integrity, only availability is affected. No known exploits in the wild have been reported at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33116. Applying this patch will remediate the infinite loop vulnerability and prevent denial of service attacks exploiting this issue.