CVE-2026-96958: CWE-407: Inefficient Algorithmic Complexity in Microsoft Microsoft .NET Framework 3.5

This vulnerability (CVE-2026-96958) involves inefficient algorithmic complexity (CWE-407) in the System.Security.Cryptography.Xml and System.Private.Xml components of Microsoft .NET Framework 3.5 and related packages. The issue allows an attacker to cause a denial of service (DoS) by triggering excessive resource consumption during XML signature processing. Microsoft has mitigated this by implementing input-depth and operation-count limits, disabling DTD processing by default, validating entity references, bounding encrypted-data candidate processing, and capping attributes and namespaces used by canonicalization transforms. The vulnerability affects multiple platforms (Windows, Linux, macOS) and multiple versions of the System.Security.Cryptography.Xml package. Official patches are available in versions 10.0.13, 11.0.0-rc.2, 8.0.5, and 9.0.21. Users should update their .NET SDKs, runtimes, and package references accordingly.

The vulnerability can be exploited remotely without privileges or user interaction to cause a denial of service (DoS) by exhausting system resources during XML cryptographic operations. There is no impact on confidentiality or integrity, but availability is affected. This can disrupt applications relying on the affected .NET components for XML signature processing.

An official fix is available. Users should update to the patched versions of the System.Security.Cryptography.Xml package (e.g., 10.0.13 or later) or install the latest .NET runtime and SDK versions. Applications referencing vulnerable packages must update their package references and redeploy. Self-contained applications targeting affected versions must be recompiled and redeployed. Restart applications after applying updates for changes to take effect.