CVE-2026-96958

Analyzed Analyzed - Analysis Complete

Denial of Service in .NET Due to Algorithmic Complexity

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Microsoft Corporation

Description

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96958

EUVD

EUVD-2026-100279

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	.net	From 8.0.0 (inc) to 8.0.5 (exc)
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	From 9.0.0 (inc) to 9.0.21 (exc)
microsoft	.net	From 10.0.0 (inc) to 10.0.13 (exc)
microsoft	.net_framework	4.8.1
microsoft	.net_framework	4.8
microsoft	.net_framework	4.6.2
microsoft	.net_framework	4.7
microsoft	.net_framework	4.7.1
microsoft	.net_framework	4.7.2
microsoft	.net_framework	3.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability involves inefficient algorithmic complexity in .NET. An unauthorized attacker can exploit this to cause a denial of service over a network by overwhelming system resources.

Impact Analysis

It can lead to service disruption, making applications or systems unresponsive. This may affect availability of services relying on .NET frameworks, especially those handling network requests.

Compliance Impact

This vulnerability enables denial-of-service attacks via inefficient algorithmic complexity in .NET, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems, potentially violating Article 32 requirements for resilience. For HIPAA, service disruption could affect ePHI availability, conflicting with Security Rule requirements for access control and integrity.

Mitigation Strategies

Apply the latest security updates from Microsoft for .NET Framework versions 3.5, 4.6.2, 4.7.x, 4.8, and 4.8.1 to address the inefficient algorithmic complexity issue.

Hi! I’m here to help you understand CVE-2026-96958. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70