Uncontrolled Recursion in Microsoft products - CVE-2026-58280

Vulnerability identifier: #VU154381

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-58280

CWE-ID: CWE-674

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in .NET when handling network interactions. A remote attacker can trigger uncontrolled recursion over the network to cause a denial of service.

.NET
Visual Studio
.NET for Linux
.NET for macOS
Microsoft .NET Framework

Install security update from vendor's website.

.NET - addressed in versions 8.0.32, 9.0.21
Visual Studio - update to 17.14.42
Microsoft .NET Framework - addressed in versions 2.0.50727.8987 AND 3.0.30729.8982, 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0, 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0, 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0, 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0, 4.7.4150.0, 4.8.4811.0, 10.0.13
.NET for Linux - addressed in versions 8.0.32, 9.0.21
.NET for macOS - addressed in versions 8.0.32, 9.0.21

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58280
• https://support.microsoft.com/help/5130035

• Multiple vulnerabilities in Microsoft Windows