CVE-2026-50527

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A Denial of Service (DoS) vulnerability (CVE-2026-50527) has been identified in the algorithm-name resolution of the System.Security.Cryptography.Xml component, which allows attackers to exhaust the stack, crashing an application that processes attacker-influenced XML. An algorithm name supplied in a transform or algorithm element is passed to type-name resolution without rejecting the CLR nested-type separator, so a pathologically deep nested-type name drives unbounded resolution work.

Per CWE-121: Stack-based Buffer Overflow, the affected buffer is allocated on the stack; in managed .NET this manifests as exhaustion of the call stack during recursive type-name resolution rather than memory corruption, terminating the process.

This issue affects .NET 6. On .NET 6, System.Security.Cryptography.Xml is not part of the shared framework; it ships as an opt-in NuGet package (https://www.nuget.org/packages/System.Security.Cryptography.Xml), so only applications that add an explicit package reference to it are exposed.

‍

Details

Module Info

• Product: .NET
• Affected packages: System.Security.Cryptography.Xml
• Affected versions: System.Security.Cryptography.Xml >= 6.0.0 < 6.0.2
• GitHub repository: https://github.com/dotnet/runtime
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager: NuGet
• Fixed in: NES for .NET 6.0.43

Vulnerability Info

This High-severity vulnerability is found in the System.Security.Cryptography.Xml package as shipped for .NET 6. When XML is loaded through SignedXml or EncryptedXml, the Algorithm name of a transform or algorithm element is resolved to a type by CryptoHelpers.CreateFromName, which first screens the name against a set of invalid characters. That set does not include +, the CLR nested-type separator:

private static readonly char[] _invalidChars = new char[] { ',', '`', '[', '*', '&' };
// ...
if (name == null || name.IndexOfAny(_invalidChars) >= 0)
{
    return null;
}

Because + is accepted, an attacker-supplied Algorithm value such as "Fake.Type" followed by tens of thousands of +A segments is forwarded to type-name resolution, which recurses deeply enough to exhaust the stack and terminate the process. Any application that references the opt-in package and processes untrusted XML signature or encryption documents is exposed, with no privileges or user interaction required, producing an availability impact.

The fixed releases add + to the rejected-character set, so a name containing the nested-type separator is rejected before any type resolution is attempted.

This vulnerability has been present since at least .NET 6.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • System.Security.Cryptography.Xml >= 8.0.4
  • System.Security.Cryptography.Xml >= 9.0.18
  • System.Security.Cryptography.Xml >= 10.0.10
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.43 or later.

‍

Credits

Microsoft credits Levi Broderick of Microsoft for reporting this vulnerability.