CVE-2026-33116
Analyzed Analyzed - Analysis Complete
Infinite Loop Vulnerability in .NET Causes Remote Denial of Service

Publication date: 2026-04-14

Last updated on: 2026-05-06

Assigner: Microsoft Corporation

Description
Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-14
Last Modified
2026-05-06
Generated
2026-06-16
AI Q&A
2026-04-14
EPSS Evaluated
2026-06-15
NVD
CVE-2026-33116
EUVD
EUVD-2026-22635
Affected Vendors & Products
Showing 10 associated CPEs
Vendor Product Version / Range
microsoft .net From 10.0.0 (inc) to 10.0.6 (exc)
microsoft .net From 8.0.0 (inc) to 8.0.26 (exc)
microsoft .net From 9.0.0 (inc) to 9.0.15 (exc)
microsoft .net_framework 3.5
microsoft .net_framework 4.7.2
microsoft .net_framework 4.6.2
microsoft .net_framework 4.7
microsoft .net_framework 4.7.1
microsoft .net_framework 4.8
microsoft .net_framework 4.8.1
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

This vulnerability is an infinite loop caused by a loop with an unreachable exit condition in .NET, .NET Framework, and Visual Studio.

An unauthorized attacker can exploit this infinite loop to cause a denial of service over a network.

Impact Analysis

The vulnerability can be exploited by an unauthorized attacker to cause a denial of service (DoS) condition.

This means that affected systems running .NET, .NET Framework, or Visual Studio could become unresponsive or unavailable due to the infinite loop.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33116. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart