Inefficient Algorithmic Complexity in Microsoft products - CVE-2026-69651

Vulnerability identifier: #VU154409

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-69651

CWE-ID: CWE-407

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in .NET when handling network input. A remote attacker can exploit the affected algorithm over a network to cause a denial of service.

.NET
Visual Studio
.NET for Linux
.NET for macOS
Microsoft .NET Framework

Install security update from vendor's website.

.NET - addressed in versions 8.0.32, 9.0.21
Visual Studio - update to 17.14.42
Microsoft .NET Framework - addressed in versions 2.0.50727.8987 AND 3.0.30729.8982, 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0, 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0, 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0, 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0, 4.7.4150.0, 4.8.4811.0, 10.0.13
.NET for Linux - addressed in versions 8.0.32, 9.0.21
.NET for macOS - addressed in versions 8.0.32, 9.0.21

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69651

• Multiple vulnerabilities in Microsoft Windows