CVE-2026-96959: CWE-770: Allocation of Resources Without Limits or Throttling in Microsoft Microsoft .NET Framework 3.5

This vulnerability (CWE-770) affects the System.Security.Cryptography.Xml package used in Microsoft .NET Framework 3.5 and later versions. It involves allocation of resources without proper limits or throttling, which can be exploited to cause a denial of service condition. The issue is addressed by adding input-depth and operation-count limits, prohibiting DTD processing by default, validating entity references, bounding encrypted-data candidate processing, and capping attributes and namespaces used by C14N transforms. Affected package versions include System.Security.Cryptography.Xml versions from 8.0.0 through 10.0.12 and certain preview and release candidate versions. Microsoft has released patched versions (e.g., 10.0.13 and later) and recommends updating to these versions and recompiling self-contained applications targeting affected versions.

The vulnerability allows an attacker to cause denial of service by exhausting system resources due to unbounded allocation in XML cryptographic processing. There is no impact on confidentiality or integrity reported. The CVSS v3.1 score is 7.5 (High), reflecting the potential for service disruption without requiring privileges or user interaction.

An official fix is available. Users should update to the patched versions of the System.Security.Cryptography.Xml package as listed by Microsoft (e.g., 10.0.13 or later). Developers should update their .NET SDKs and runtimes accordingly and recompile and redeploy any self-contained applications targeting affected versions. Restart applications after applying updates to ensure the fix takes effect. Refer to the Microsoft Security Response Center advisory for detailed update instructions.