CVE-2026-84008: CWE-407: Inefficient Algorithmic Complexity in Microsoft Microsoft .NET Framework 3.5

This vulnerability (CVE-2026-84008) is due to inefficient algorithmic complexity (CWE-407) in the SignedCms.CheckSignature method of the System.Security.Cryptography.Pkcs package used in Microsoft .NET Framework 3.5 and other versions. The method can be forced to repeatedly reparse attacker-controlled X.509 data, leading to quadratic CPU exhaustion without authentication. The vulnerability affects multiple package versions across platforms. Microsoft has provided official fixes in updated package versions, requiring developers to update their .NET SDKs and package references accordingly.

The vulnerability allows an unauthenticated attacker to cause a denial of service by exhausting CPU resources through repeated parsing of malicious X.509 data. There is no impact on confidentiality or integrity, but availability is affected due to high CPU usage. This can degrade or disrupt service on affected systems running vulnerable versions of the .NET Framework or packages.

An official fix is available. Users should update to the patched versions of the System.Security.Cryptography.Pkcs package as listed by Microsoft (e.g., 10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21). Additionally, updating to the latest .NET runtime or SDK and recompiling and redeploying any self-contained applications targeting affected versions is required. Restart applications after updating for the fix to take effect.