CVE-2026-33116: 
C# vulnerability analysis and mitigation

CVE-2026-33116 is a Denial of Service (DoS) vulnerability in Microsoft .NET, .NET Framework, and Visual Studio caused by an infinite loop condition in the XmlDecryptionTransform component (specifically the EncryptedXml class within the System.Security.Cryptography.Xml NuGet package). A remote, unauthenticated attacker can craft a malicious XML document to trigger infinite recursion, rendering the affected system unresponsive. Affected versions include .NET 8.0.0–8.0.2, 9.0.0–9.0.14, and 10.0.0–10.0.5, as well as .NET Framework versions 3.5, 4.6.2, 4.7–4.8.1. The vulnerability was disclosed and patched on April 14, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Microsoft MSRC).

The root cause is an improper restriction of recursive processing within the EncryptedXml class in System.Security.Cryptography.Xml, classified under CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop), CWE-400 (Uncontrolled Resource Consumption), CWE-776 (Improper Restriction of Recursive Entity References in DTDs), and CWE-20 (Improper Input Validation). An attacker exploits this by submitting a specially crafted XML document over the network that triggers infinite recursion during XML decryption processing, exhausting CPU and/or stack resources. No authentication, user interaction, or elevated privileges are required — the attack vector is purely network-based with low complexity. The vulnerability was credited to researcher Ludvig Pedersen (GitHub Advisory).

Successful exploitation results in a complete availability impact — the affected application or service becomes unresponsive due to infinite CPU/stack consumption, constituting a Denial of Service. There is no confidentiality or integrity impact; the vulnerability cannot be used to access or modify data. Any application that processes attacker-controlled XML documents using the affected System.Security.Cryptography.Xml package is at risk, including web services, APIs, and enterprise applications built on .NET or .NET Framework (GitHub Advisory, Microsoft MSRC).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.87% (per Feedly data) to 8.01% (per GitHub Advisory Database, 92nd percentile), reflecting a moderate-to-elevated probability of exploitation within 30 days relative to other CVEs. No threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify applications or services that accept XML input and are built on affected versions of .NET (8.0.0–8.0.2, 9.0.0–9.0.14, 10.0.0–10.0.5) or .NET Framework (3.5–4.8.1), particularly those using the System.Security.Cryptography.Xml package for XML decryption.
2. Craft malicious XML: Construct a specially crafted XML document that exploits the EncryptedXml class's lack of recursion depth limits — for example, by creating deeply nested or self-referential XML encryption structures that trigger an infinite loop during decryption processing.
3. Deliver the payload: Submit the malicious XML document to the target application via any available input channel (e.g., HTTP POST body, SOAP request, file upload endpoint, or any API that processes XML).
4. Trigger DoS: The application's XML decryption routine enters an infinite loop, consuming all available CPU or stack resources, causing the process to hang or crash and making the service unavailable to legitimate users (GitHub Advisory).

• Process Behavior: .NET application processes (e.g., dotnet.exe, w3wp.exe, aspnetcore) exhibiting sustained 100% CPU utilization with no corresponding legitimate workload spike.
• Logs: Application logs showing XML decryption operations that never complete; stack overflow exceptions or timeout errors originating from System.Security.Cryptography.Xml.EncryptedXml or XmlDecryptionTransform.
• Network: Repeated or high-volume XML document submissions to endpoints that perform XML decryption, particularly from unexpected source IPs.
• Availability: Sudden unresponsiveness or crash of .NET-based services coinciding with receipt of XML input, without other apparent cause.

Microsoft released patches on April 14, 2026 as part of the April 2026 Patch Tuesday update. For the System.Security.Cryptography.Xml NuGet package, update to: 10.0.6 (for .NET 10), 9.0.15 (for .NET 9), or 8.0.3 (for .NET 8). For .NET Framework, apply the corresponding Microsoft security updates for versions 3.5, 4.6.2, 4.7–4.8.1 as detailed in the MSRC advisory. Developers should update the NuGet package reference and recompile/redeploy their applications; updating the runtime/SDK alone is not sufficient to patch the NuGet package dependency. As a temporary workaround where patching is delayed, implement network segmentation and input validation to restrict or sanitize XML documents before they reach the decryption layer (GitHub Advisory, Microsoft MSRC).

The vulnerability was covered as part of Microsoft's April 2026 Patch Tuesday, which addressed 167 flaws in total. Security outlets including BleepingComputer, Rapid7, Zero Day Initiative (ZDI), and SANS ISC included CVE-2026-33116 in their Patch Tuesday roundups, noting it as one of several .NET-related DoS issues addressed in the release. Red Hat, Ubuntu, Rocky Linux, and AlmaLinux subsequently issued their own advisories and errata for affected .NET packages on their platforms. No significant controversy or notable researcher commentary specific to this CVE has been observed beyond standard patch coverage (BleepingComputer, ZDI Blog, Rapid7 Blog).