Microsoft .NET: Denial of service via uncontrolled recursion in XML processing

Summary

Microsoft .NET runtimes and .NET Framework contain an uncontrolled recursion flaw in the processing of XML digital signatures and XML encryption (System.Security.Cryptography.Xml and System.Private.Xml). An unauthenticated attacker on the network can send a deeply nested or recursive XML document and crash the process, causing a denial of service. Exposure is highest for internet-facing applications that accept XML signatures or encrypted XML from external parties. No loss of confidentiality or integrity is expected.

Affected

• .NET 8.0.0 to before 8.0.32
• .NET 9.0.0 to before 9.0.21
• .NET 10.0.0 to before 10.0.13
• .NET 11.0.0-preview.1 to before 11.0.0-rc.2
• .NET Framework versions listed in the Microsoft advisory (several Windows builds)
• Self-contained applications built for the affected versions
• .NET 6: disputed, unconfirmed by Microsoft; .NET 7 is end of life

Fixed in

• .NET 8.0.32 (runtime), SDK 8.0.426
• .NET 9.0.21 (runtime), SDK 9.0.319
• .NET 10.0.13
• .NET 11.0.0-rc.2
• .NET Framework: October 13, 2026 cumulative updates, e.g. KB5127694 and KB5127696
• Self-contained applications: recompile and redeploy after patching the runtime

Workaround

Unknown for unpatched systems. Microsoft has not documented an official workaround. As an interim measure, review where applications process XML from untrusted sources.

Exploitation

• No known exploitation in the wild
• Not listed in the CISA KEV catalogue
• No public proof of concept found
• CISA SSVC: exploitation none, automatable yes, technical impact partial

Our recommendation

• Patch .NET 8, 9, 10 and 11 runtimes and SDKs to the fixed versions
• Apply the October 2026 .NET Framework cumulative updates on Windows systems
• Recompile and redeploy self-contained applications
• Check for .NET 6 and .NET 7 installations and plan their upgrade
• Prioritise internet-facing services that process XML signatures or encrypted XML from external parties
• Monitor application crashes and restarts for signs of abuse

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide CVE-2026-58280 msrc.microsoft.com
• Microsoft .NET announcement and advisory copy github.com
• Microsoft KB5127694 .NET Framework update support.microsoft.com
• Microsoft KB5127696 .NET Framework update support.microsoft.com
• Ubuntu security notice CVE-2026-58280 ubuntu.com
• Red Hat CVE record CVE-2026-58280 access.redhat.com
• HeroDevs vulnerability directory CVE-2026-58280 www.herodevs.com
• Rapid7 vulnerability database CVE-2026-58280 www.rapid7.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:32.