CVE-2026-70162

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A denial of service vulnerability (CVE-2026-70162) has been identified in .NET's CMS/PKCS#7 enveloped-message support, EnvelopedCms in System.Security.Cryptography.Pkcs. Microsoft describes the issue as EnvelopedCms.Decode on Windows performing quadratic work while processing attacker-supplied CMS or PKCS#7 attributes, causing pre-authentication CPU exhaustion. Linux and macOS are not affected.

Per CWE-405: Asymmetric Resource Consumption (Amplification), the product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization.

This issue affects .NET 6 on Windows, including NES for .NET releases through 6.0.46. System.Security.Cryptography.Pkcs ships in-box in the Windows Desktop shared framework and in the ASP.NET Core shared framework's runtime, and as a standalone NuGet package. Applications are exposed when they decode CMS or PKCS#7 enveloped (encrypted) messages from untrusted sources with EnvelopedCms. Microsoft's advisory lists the System.Security.Cryptography.Pkcs package for 8.0, 9.0, 10.0 and the 11.0 previews as affected, on Windows only; .NET 6 is past end of life and is not assessed there.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: .NET
• Affected packages: Microsoft.WindowsDesktop.App and Microsoft.AspNetCore.App (in-box copies of System.Security.Cryptography.Pkcs); System.Security.Cryptography.Pkcs (standalone NuGet package)
• Affected versions:
  
  • Microsoft.AspNetCore.App, Microsoft.WindowsDesktop.App >= 6.0.0 <= 6.0.46 (Windows)
  • System.Security.Cryptography.Pkcs >= 6.0.0 <= 6.0.5 (Windows)
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/runtime
• Published packages: Download .NET (Windows); System.Security.Cryptography.Pkcs on NuGet
• Fixed in: NES for .NET 6.0.47 (System.Security.Cryptography.Pkcs 6.0.5.1)

Vulnerability Info

This Medium-severity vulnerability is found in the Windows implementation of EnvelopedCms in System.Security.Cryptography.Pkcs as shipped for .NET 6. When EnvelopedCms.Decode reads a message's unprotected attributes on Windows, it added each one with CryptographicAttributeObjectCollection.Add, which merges attributes that share an object identifier. Each merge searches the attributes already collected, so the work grew quadratically with the number of attributes in the message. The Linux and macOS implementation, and SignedCms on every platform, already added attributes without merging.

NES for .NET 6.0.47 applies Microsoft's fix: the Windows path now uses AddWithoutMerge, matching the other platforms. As a side effect, on Windows EnvelopedCms.UnprotectedAttributes now lists attributes that share an object identifier as separate entries, as it already did on Linux and macOS.

This vulnerability has been present since at least .NET 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • NES for .NET 6.0.47 or later
  • System.Security.Cryptography.Pkcs 8.0.2 or later (.NET 8)
  • System.Security.Cryptography.Pkcs 9.0.21 or later (.NET 9)
  • System.Security.Cryptography.Pkcs 10.0.13 or later (.NET 10)
• Microsoft's advisory also directs .NET 8, 9 and 10 users to install the October runtime (8.0.32, 9.0.21 or 10.0.13), which updates the in-box copy.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later. Applications with an explicit System.Security.Cryptography.Pkcs package reference should also move it to 6.0.5.1 from the NES feed, because NuGet otherwise keeps resolving Microsoft's unpatched 6.0.5.

Credits

Dr.-Ing Ashar Javed (@soaj1664ashar), as credited in Microsoft's advisory.