Microsoft .NET: Denial of service in CMS/PKCS#7 signature verification

Summary

A flaw in SignedCms.CheckSignature in the .NET System.Security.Cryptography.Pkcs component lets an unauthenticated remote attacker send crafted X.509 data that is repeatedly re-parsed, causing quadratic CPU exhaustion and denial of service. The issue only affects applications that decode and verify CMS/PKCS#7 signed messages from untrusted sources. The NVD score is 7.5 (CVSS 3.1), but real exposure is narrower than the score suggests.

Affected

• Microsoft .NET Framework and .NET packages with System.Security.Cryptography.Pkcs before the fixed versions listed in the CVE record (e.g. 10.0.0 to below 10.0.13)
• Per the mirrored Microsoft advisory: Pkcs 8.0.0-8.0.1, 9.0.0-9.0.20, 10.0.0-10.0.12, 11.0.0-preview.1 to 11.0.0-rc.1
• .NET 6: affected on all platforms; no upstream fix (NES for .NET releases through 6.0.46)
• Visual Studio 2022 version 17.14 before 17.14.42; Visual Studio 2026 version 18.10 before 18.10.4
• .NET Framework 3.5 and 4.6.2 to 4.8.1: listed in the CVE record, not yet confirmed on MSRC
• .NET 7: unknown

Fixed in

• System.Security.Cryptography.Pkcs 8.0.2, 9.0.21, 10.0.13 and 11.0.0-rc.2
• .NET runtimes 8.0.32, 9.0.21 and 10.0.13 (October 2026 updates)
• Visual Studio 2022 17.14.42 and Visual Studio 2026 18.10.4
• .NET 6: fix only in paid NES for .NET 6.0.47; no upstream Microsoft fix
• .NET Framework: fixed builds as listed in the CVE record (e.g. 4.8.4811.0 for 4.8, 4.8.9363.0 for 4.8.1); verify on MSRC

Workaround

Unknown. No vendor-documented workaround for unpatched systems was found. Update direct package references to the patched version.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact partial
• No listing found in CISA KEV; not confirmed as exploited
• No public proof of concept found
• EPSS 0.00766 (about 0.8% estimated probability of exploitation within 30 days, per Tenable)

Our recommendation

• Install the patched .NET runtime or Pkcs package in the next monthly patch cycle
• Check whether any application uses SignedCms to verify CMS/PKCS#7 messages from third parties; escalate internet-facing ASP.NET services that do so
• Identify .NET 6 systems: no upstream fix exists, so plan migration or evaluate paid NES support
• .NET 8 and 9 reach end of support on 10 November 2026; plan upgrades to a supported release
• Scan projects for transitive dependencies on System.Security.Cryptography.Pkcs, including templates and code-generation packages
• Monitor CISA KEV and vendor advisories for changes in exploitation status

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-84008 msrc.microsoft.com
• GitHub Advisory GHSA-846f-f764-76mx (Microsoft advisory mirror) github.com
• HeroDevs vulnerability directory: CVE-2026-84008 www.herodevs.com
• HeroDevs blog: .NET crypto CVEs (SAML/CMS DoS, .NET 6) www.herodevs.com
• Ubuntu security notice CVE-2026-84008 ubuntu.com
• Microsoft Visual Studio 2026 release notes learn.microsoft.com
• Tenable CVE-2026-84008 (EPSS) www.tenable.com
• Project template scanner finding (transitive dependency) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:42.