This vulnerability, identified as CVE-2026-33116 and classified under CWE-835 (Loop with Unreachable Exit Condition), exists in Microsoft .NET 10.0. It allows an attacker without privileges or user interaction to induce an infinite loop, causing a denial of service condition remotely. The CVSS 3.1 base score is 7.5, reflecting high severity due to network attack vector, low attack complexity, no privileges required, and no user interaction needed. Microsoft has published an official fix for this vulnerability as indicated in their security advisory.

An attacker can exploit this vulnerability remotely to cause a denial of service by triggering an infinite loop in the affected .NET runtime. This results in service unavailability or resource exhaustion on the targeted system. There is no impact on confidentiality or integrity, only availability is affected. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33116 to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the patch.