Microsoft .NET: Denial of Service through stack-based buffer overflow

Summary

A stack-based buffer overflow in the Microsoft .NET runtime allows an unauthenticated remote attacker to cause a denial of service. According to the advisory, a crafted request line is processed recursively and exhausts the stack, which can crash or stall the affected process. Exploitation requires only network access to a service that uses the affected component, such as HttpListener, and does not require privileges or user interaction.

Affected

• Microsoft .NET 8.0 from 8.0.0 before 8.0.34
• Microsoft .NET 9.0 from 9.0.0 before 9.0.23
• Microsoft .NET 10.0 from 10.0.0 before 10.0.15
• Microsoft .NET 11.0 from 11.0.0-preview.1 before 11.0.0
• The CVE record lists Linux and macOS. The research notes treat the issue as cross-platform; verify the platform list in the MSRC advisory.
• Self-contained applications that embed their own runtime are affected independently of the installed runtime.

Fixed in

• .NET 8.0.34 or later
• .NET 9.0.23 or later
• .NET 10.0.15 or later
• .NET 11.0.0 or later

Workaround

Unknown. No vendor-documented workaround was found in the sources checked. Patching is the remedy.

• Interim measure if patching is delayed (own recommendation, not from a vendor source): restrict network access to services that use HttpListener.

Exploitation

• Not known to be exploited in the wild.
• Rapid7 rates exploitation as "Exploitation Less Likely".
• No public proof of concept found.
• CISA SSVC: automatable yes, technical impact partial.

Our recommendation

• Inventory all .NET 8, 9, 10 and 11 runtimes and self-contained applications.
• Install the fixed runtime versions listed above, or update the referenced packages.
• Restart services and redeploy self-contained applications after rebuilding them, because a machine-wide runtime update does not replace their embedded copy.
• Prioritise internet-facing and partner-facing services that use HttpListener or self-contained .NET applications.
• Verify exposure against the MSRC advisory, since the research notes could not confirm the version table there.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-109475 msrc.microsoft.com
• .NET and .NET Framework November 2026 servicing updates devblogs.microsoft.com
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• dotnet/announcements #498 github.com
• dotnet/runtime issue #137283 github.com
• GitLab advisory mirror of Microsoft advisory advisories.gitlab.com
• Strix CVE-2026-109475 www.strix.ai
• OffSeq CVE-2026-109475 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:06.