CVE-2026-58280 - Vulnerability Details - OpenCVE

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft Subscribe	.net Subscribe .net Framework Subscribe Microsoft Visual Studio 2026 Version 18.10 Subscribe Visual Studio 2022 Subscribe

No data.

No data.

No data.

Advisories

Source	ID	Title
Github GHSA	GHSA-mc4q-93x5-f6hj	Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58280

History

Tue, 13 Oct 2026 19:15:00 +0000

Type	Values Removed	Values Added
Description		Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
Title		.NET Denial of Service Vulnerability
First Time appeared		Microsoft Microsoft .net Microsoft .net Framework Microsoft microsoft Visual Studio 2026 Version 18.10 Microsoft visual Studio 2022
Weaknesses		CWE-674
CPEs		cpe:2.3:a:microsoft:.net:::::::: cpe:2.3:a:microsoft:.net_framework:::::::: cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.10:::::::: cpe:2.3:a:microsoft:visual_studio_2022::::::::
Vendors & Products		Microsoft Microsoft .net Microsoft .net Framework Microsoft microsoft Visual Studio 2026 Version 18.10 Microsoft visual Studio 2022
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58280
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-10-13T19:01:30.776Z

Updated: 2026-10-13T20:37:38.083Z

Reserved: 2026-06-29T21:59:30.870Z

Link: CVE-2026-58280

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-10-13T19:18:52.810

Modified: 2026-10-13T19:30:29.797

Link: CVE-2026-58280

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-674

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58280", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-06-29T21:59:30.870Z", "datePublished": "2026-10-13T19:01:30.776Z", "dateUpdated": "2026-10-13T20:37:38.083Z"}, "containers": {"cna": {"title": ".NET Denial of Service Vulnerability", "datePublic": "2026-10-13T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.0.21"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "8.0.32"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.0", "versionEndExcluding": "10.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.0-rc.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8.1", "versionEndExcluding": "2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8.0.0", "versionEndExcluding": "4.8.9363.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.10:*:*:*:*:*:*:*:*", "versionStartIncluding": "18.10.0", "versionEndExcluding": "18.10.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.14.0", "versionEndExcluding": "17.14.42"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5.0", "versionEndExcluding": "2.0.50727.9188 AND 3.0.30729.9171"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0.0.0", "versionEndExcluding": "2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7.0", "versionEndExcluding": "2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8.0", "versionEndExcluding": "2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7.0", "versionEndExcluding": "4.7.4150.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8.0", "versionEndExcluding": "4.8.4811.0"}]}]}], "affected": [{"vendor": "Microsoft", "product": ".NET 10.0", "versions": [{"version": "10.0.0", "lessThan": "10.0.13", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 11.0", "versions": [{"version": "11.0.0", "lessThan": "11.0.0-rc.2", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 8.0", "versions": [{"version": "8.0.0", "lessThan": "8.0.32", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 9.0", "versions": [{"version": "9.0.0", "lessThan": "9.0.21", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5", "platforms": ["Windows 11 version 26H1", "Windows Server 2012", "Windows Server 2012 R2"], "versions": [{"version": "3.5.0", "lessThan": "2.0.50727.9188 AND 3.0.30729.9171", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2", "platforms": ["Windows 10 version 1607", "Windows Server 2016", "Windows Server 2019"], "versions": [{"version": "3.0.0.0", "lessThan": "2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.7.2", "platforms": ["Windows 10 version 1809"], "versions": [{"version": "4.7.0", "lessThan": "2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.8", "platforms": ["Windows 10 version 1809", "Windows 10 version 21H2", "Windows 10 version 22H2", "Windows Server 2019", "Windows Server 2022"], "versions": [{"version": "4.8.0", "lessThan": "2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 3.5 AND 4.8.1", "platforms": ["Windows 10 version 21H2", "Windows 10 version 22H2", "Windows 11 version 23H2", "Windows 11 version 24H2", "Windows 11 version 25H2", "Windows 11 version 26H2", "Windows Server 2022", "Windows Server 2025"], "versions": [{"version": "4.8.1", "lessThan": "2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2", "platforms": ["Windows Server 2012", "Windows Server 2012 R2"], "versions": [{"version": "4.7.0", "lessThan": "4.7.4150.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 4.8", "platforms": ["Windows 10 version 1607", "Windows Server 2012", "Windows Server 2012 R2", "Windows Server 2016"], "versions": [{"version": "4.8.0", "lessThan": "4.8.4811.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft .NET Framework 4.8.1", "platforms": ["Windows 11 version 26H1"], "versions": [{"version": "4.8.0.0", "lessThan": "4.8.9363.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.14", "versions": [{"version": "17.14.0", "lessThan": "17.14.42", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2026 version 18.10", "versions": [{"version": "18.10.0", "lessThan": "18.10.4", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-674: Uncontrolled Recursion", "lang": "en-US", "type": "CWE", "cweId": "CWE-674"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-10-13T20:37:38.083Z"}, "references": [{"name": ".NET Denial of Service Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58280"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}}]}}}

{"affected": [{"affectedData": [{"product": ".NET 10.0", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.13", "status": "affected", "version": "10.0.0", "versionType": "custom"}]}, {"product": ".NET 11.0", "vendor": "Microsoft", "versions": [{"lessThan": "11.0.0-rc.2", "status": "affected", "version": "11.0.0", "versionType": "custom"}]}, {"product": ".NET 8.0", "vendor": "Microsoft", "versions": [{"lessThan": "8.0.32", "status": "affected", "version": "8.0.0", "versionType": "custom"}]}, {"product": ".NET 9.0", "vendor": "Microsoft", "versions": [{"lessThan": "9.0.21", "status": "affected", "version": "9.0.0", "versionType": "custom"}]}, {"platforms": ["Windows 11 version 26H1", "Windows Server 2012", "Windows Server 2012 R2"], "product": "Microsoft .NET Framework 3.5", "vendor": "Microsoft", "versions": [{"lessThan": "2.0.50727.9188 AND 3.0.30729.9171", "status": "affected", "version": "3.5.0", "versionType": "custom"}]}, {"platforms": ["Windows 10 version 1607", "Windows Server 2016", "Windows Server 2019"], "product": "Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2", "vendor": "Microsoft", "versions": [{"lessThan": "2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0", "status": "affected", "version": "3.0.0.0", "versionType": "custom"}]}, {"platforms": ["Windows 10 version 1809"], "product": "Microsoft .NET Framework 3.5 AND 4.7.2", "vendor": "Microsoft", "versions": [{"lessThan": "2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0", "status": "affected", "version": "4.7.0", "versionType": "custom"}]}, {"platforms": ["Windows 10 version 1809", "Windows 10 version 21H2", "Windows 10 version 22H2", "Windows Server 2019", "Windows Server 2022"], "product": "Microsoft .NET Framework 3.5 AND 4.8", "vendor": "Microsoft", "versions": [{"lessThan": "2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0", "status": "affected", "version": "4.8.0", "versionType": "custom"}]}, {"platforms": ["Windows 10 version 21H2", "Windows 10 version 22H2", "Windows 11 version 23H2", "Windows 11 version 24H2", "Windows 11 version 25H2", "Windows 11 version 26H2", "Windows Server 2022", "Windows Server 2025"], "product": "Microsoft .NET Framework 3.5 AND 4.8.1", "vendor": "Microsoft", "versions": [{"lessThan": "2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0", "status": "affected", "version": "4.8.1", "versionType": "custom"}]}, {"platforms": ["Windows Server 2012", "Windows Server 2012 R2"], "product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2", "vendor": "Microsoft", "versions": [{"lessThan": "4.7.4150.0", "status": "affected", "version": "4.7.0", "versionType": "custom"}]}, {"platforms": ["Windows 10 version 1607", "Windows Server 2012", "Windows Server 2012 R2", "Windows Server 2016"], "product": "Microsoft .NET Framework 4.8", "vendor": "Microsoft", "versions": [{"lessThan": "4.8.4811.0", "status": "affected", "version": "4.8.0", "versionType": "custom"}]}, {"platforms": ["Windows 11 version 26H1"], "product": "Microsoft .NET Framework 4.8.1", "vendor": "Microsoft", "versions": [{"lessThan": "4.8.9363.0", "status": "affected", "version": "4.8.0.0", "versionType": "custom"}]}, {"product": "Microsoft Visual Studio 2022 version 17.14", "vendor": "Microsoft", "versions": [{"lessThan": "17.14.42", "status": "affected", "version": "17.14.0", "versionType": "custom"}]}, {"product": "Microsoft Visual Studio 2026 version 18.10", "vendor": "Microsoft", "versions": [{"lessThan": "18.10.4", "status": "affected", "version": "18.10.0", "versionType": "custom"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network."}], "id": "CVE-2026-58280", "lastModified": "2026-10-13T19:30:29.797", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2026-10-13T19:18:52.810", "references": [{"source": "[email protected]", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58280"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "[email protected]", "type": "Primary"}]}