This vulnerability (CVE-2026-33116) in Microsoft .NET 10.0 arises from an infinite loop due to unreachable exit conditions within the XmlDecryptionTransform component. A remote attacker can exploit this flaw by crafting malicious XML documents that cause infinite recursion, leading to denial of service (DoS) by making the system unresponsive. The issue is classified under CWE-835 (Loop with Unreachable Exit Condition) and CWE-776 (Improper Restriction of Recursive Entity References in DTDs). The vulnerability has a CVSS v3.1 base score of 7.5 (high severity) with network attack vector, low complexity, no privileges or user interaction required, and impacts availability only. An official fix is available from Microsoft.

Exploitation of this vulnerability results in a denial of service condition by causing the affected application or system to enter an infinite recursion loop when processing specially crafted XML data. This leads to resource exhaustion and unresponsiveness, impacting availability. There is no impact on confidentiality or integrity. No known exploits are currently observed in the wild.

An official fix is available from Microsoft for this vulnerability. Users and administrators should apply the provided patch to .NET 10.0 to remediate the issue. No alternative mitigations meeting Red Hat's criteria are currently available. Systems should be updated promptly to prevent denial of service attacks exploiting this flaw.