CVE-2026-57108

Analyzed Analyzed - Analysis Complete

Type Confusion in .NET Core Leads to DoS

Publication date: 2026-07-14

Last updated on: 2026-07-22

Assigner: Microsoft Corporation

Description

Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-22

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-57108

EUVD

EUVD-2026-44278

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	.net	From 8.0.0 (inc) to 8.0.29 (exc)
microsoft	.net	From 9.0.0 (inc) to 9.0.18 (exc)
microsoft	.net	From 10.0.0 (inc) to 10.0.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

Executive Summary

This vulnerability is a type confusion issue in .NET Core where an attacker can exploit incompatible type handling to cause a denial of service over a network.

Impact Analysis

An unauthorized attacker could exploit this flaw to disrupt services by causing crashes or unresponsiveness in systems running affected .NET Core versions.

Compliance Impact

This vulnerability primarily impacts service availability. Compliance risks may arise if downtime affects data processing or access, potentially violating availability requirements in GDPR or HIPAA.

Mitigation Strategies

Apply the latest security updates from Microsoft for .NET Core as soon as possible to patch the type confusion vulnerability that enables denial of service attacks.

Hi! I’m here to help you understand CVE-2026-57108. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70