This vulnerability is a stack-based buffer overflow (CWE-121) in Active Directory Federation Services (AD FS) affecting Microsoft .NET Framework versions 3.5 up to and including 4.7.2. Exploitation of this vulnerability can lead to denial of service (DoS) conditions remotely without requiring user interaction or privileges. The vulnerability has been assigned CVE-2026-50411 and has a CVSS v3.1 base score of 7.5, indicating high severity. Microsoft has released an official fix to remediate this issue, as documented in their security update guide.

An attacker can exploit this vulnerability remotely to cause a denial of service condition in Active Directory Federation Services (AD FS) by triggering a stack-based buffer overflow. This results in service disruption but does not impact confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for .NET Framework versions 3.5 through 4.7.2 to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50411 for detailed patch information and update instructions.