CVE-2026-70162: CWE-405: Asymmetric Resource Consumption (Amplification) in Microsoft Microsoft Visual Studio 2022 version 17.14

This vulnerability (CVE-2026-70162) affects Microsoft .NET projects using the System.Security.Cryptography.Pkcs package on Windows. The EnvelopedCms.Decode method can be exploited by an attacker supplying specially crafted CMS or PKCS#7 attributes, causing the method to perform quadratic computational work, resulting in asymmetric resource consumption and CPU exhaustion before authentication. The issue is tracked as CWE-405 (Asymmetric Resource Consumption). Affected package versions include System.Security.Cryptography.Pkcs versions >=8.0.0 <=8.0.1, >=9.0.0 <=9.0.20, >=10.0.0 <=10.0.12, and preview/RC versions 11.0.0-preview.1 through 11.0.0-rc.1. Patched versions have been released (e.g., 10.0.13, 11.0.0-rc.2). The vulnerability has a CVSS v3.1 score of 5.9 (medium severity) and does not impact confidentiality or integrity but affects availability due to CPU exhaustion. Microsoft has provided official fixes and guidance to update affected packages and .NET SDKs. Self-contained applications targeting affected versions must be recompiled and redeployed.

The vulnerability causes pre-authentication CPU exhaustion on Windows systems running affected versions of the System.Security.Cryptography.Pkcs package. This results in denial of service by consuming excessive CPU resources when processing maliciously crafted CMS or PKCS#7 attributes. There is no impact on confidentiality or integrity, only availability is affected.

An official fix is available. Users should update to the patched versions of the System.Security.Cryptography.Pkcs package (e.g., 10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21) or later. Additionally, updating to the latest .NET SDK or runtime is recommended. Applications must be restarted after updates. Self-contained applications built with affected package versions must be recompiled and redeployed with the patched versions. Follow Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70162 for detailed update instructions.