Microsoft Net Framework vulnerabilities

CVE-2026-50525 [HIGH] CWE-770 CVE-2026-50525: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

CVE-2026-96959 [HIGH] CWE-770 CVE-2026-96959: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

CVE-2026-32177 [HIGH] CWE-20 CVE-2026-32177: Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally. Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.

CVE-2017-0248 [HIGH] CWE-295 CVE-2017-0248: Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypa Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability."

CVE-2006-1510 [MEDIUM] CVE-2006-1510: Buffer overflow in calloc.c in the Microsoft Windows XP SP2 ntdll.dll system library, when used by t Buffer overflow in calloc.c in the Microsoft Windows XP SP2 ntdll.dll system library, when used by the ILDASM disassembler in the Microsoft .NET 1.0 and 1.1 SDK, might allow user-assisted attackers to execute arbitrary code via a crafted .dll file with a large static method.

CVE-2026-50647 [HIGH] CWE-835 CVE-2026-50647: Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD F Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

CVE-2026-50653 [HIGH] CWE-400 CVE-2026-50653: Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthori Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.

CVE-2026-50650 [HIGH] CWE-94 CVE-2026-50650: Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized a Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.

CVE-2017-8585 [HIGH] CWE-20 CVE-2017-8585: Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requ Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service, aka .NET Denial of Service Vulnerability.

CVE-2002-0369 [CRITICAL] CVE-2002-0369: Buffer overflow in ASP.NET Worker Process allows remote attackers to cause a denial of service (rest Buffer overflow in ASP.NET Worker Process allows remote attackers to cause a denial of service (restart) and possibly execute arbitrary code via a routine that processes cookies while in StateServer mode.

CVE-2026-35433 [HIGH] CWE-20 CVE-2026-35433: Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally. Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.

CVE-2020-1046 [HIGH] CVE-2020-1046: A remote code execution vulnerability exists when Microsoft .NET Framework processes input. An attac A remote code execution vulnerability exists when Microsoft .NET Framework processes input. An attacker who successfully exploited this vulnerability could take control of an affected system. To exploit the vulnerability, an attacker would need to be able to upload a specially crafted file to a web application. The security update addresses the vulnerability by

CVE-2018-0764 [HIGH] CVE-2018-0764: Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents are processed, aka ".NET and .NET Core Denial Of Service Vulnerability". This CVE is unique from CVE-2018-0765.

CVE-2018-0765 [HIGH] CWE-611 CVE-2018-0765: A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, a A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.7.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1, Microsoft .NET Framework 4.5.2, Microsoft

CVE-2018-0786 [HIGH] CWE-295 CVE-2018-0786: Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Co Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."

CVE-2026-50659 [MEDIUM] CWE-116 CVE-2026-50659: Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing ov Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.

CVE-2022-26929 [HIGH] CVE-2022-26929: .NET Framework Remote Code Execution Vulnerability .NET Framework Remote Code Execution Vulnerability

CVE-2024-21409 [HIGH] CWE-416 CVE-2024-21409: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

CVE-2023-24936 [HIGH] CVE-2023-24936: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

CVE-2019-0981 [HIGH] CVE-2019-0981: A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requ A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980.