CVE-2026-58280: CWE-674: Uncontrolled Recursion in Microsoft .NET 10.0

This vulnerability, identified as CWE-674 (Uncontrolled Recursion), affects Microsoft .NET projects using certain versions of runtime packages. It arises from insufficient control over recursion depth in XML processing components, specifically System.Security.Cryptography.Xml and System.Private.Xml. The uncontrolled recursion can cause denial of service by exhausting resources. Microsoft has released official patches for affected versions, which include enhanced input validation and limits to prevent excessive recursion and related resource exhaustion. The CVSS 3.1 score is 7.5 (High), with an attack vector of network, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

The vulnerability can be exploited remotely without authentication or user interaction to cause a denial of service condition by triggering uncontrolled recursion in XML processing. There is no impact on confidentiality or integrity. The affected platforms include Windows, Linux, and macOS across multiple architectures. The denial of service impact can disrupt applications relying on the affected .NET runtime components.

An official fix is available from Microsoft. Users and developers should update to the patched versions of the affected Microsoft.NETCore.App.Runtime packages as listed in the advisory. The vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58280 provides detailed guidance and should be consulted for the latest remediation information. No additional mitigation is required beyond applying the official patches.