CVE-2026-50648

Analyzed Analyzed - Analysis Complete

Resource Exhaustion Vulnerability in .NET Framework

Publication date: 2026-07-14

Last updated on: 2026-07-24

Assigner: Microsoft Corporation

Description

Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-24

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-50648

EUVD

EUVD-2026-44398

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	.net_framework	4.8
microsoft	.net_framework	4.6.2
microsoft	.net_framework	4.7
microsoft	.net_framework	4.7.1
microsoft	.net_framework	4.7.2
microsoft	.net_framework	3.5
microsoft	.net_framework	4.8.1
microsoft	.net	From 8.0.0 (inc) to 8.0.29 (exc)
microsoft	.net	From 9.0.0 (inc) to 9.0.18 (exc)
microsoft	.net	From 10.0.0 (inc) to 10.0.6 (exc)
microsoft	visual_studio_2022	From 17.12.0 (inc) to 17.12.22 (exc)
microsoft	visual_studio_2022	From 17.14.0 (inc) to 17.14.36 (exc)
microsoft	visual_studio_2026	From 18.7.0 (inc) to 18.7.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in .NET Framework involves allocating system resources without proper limits or throttling. An unauthorized attacker can exploit this to consume excessive resources over a network, leading to a denial of service.

Detection Guidance

This vulnerability involves resource exhaustion in .NET Framework leading to denial of service. Detection requires monitoring for unusual resource consumption patterns in .NET applications or network traffic anomalies targeting .NET services. Check for high memory or CPU usage in .NET processes and inspect network traffic for repeated requests to .NET endpoints.

Impact Analysis

An attacker could exploit this to make systems unresponsive or crash, disrupting services that rely on .NET Framework. This may cause downtime for applications, websites, or services using affected versions.

Compliance Impact

The vulnerability allows unauthorized denial of service over a network, which could disrupt services handling sensitive data. This may impact compliance with GDPR (availability principle) or HIPAA (security rule) if critical systems are affected.

Mitigation Strategies

Apply the latest security updates from Microsoft for .NET Framework to address the resource allocation issue. Monitor network traffic for unusual patterns indicating denial of service attempts.

Hi! I’m here to help you understand CVE-2026-50648. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70