Loading story…
Microsoft disclosed CVE-2026-50525, a high-severity denial-of-service flaw in the .NET XML cryptography stack that can let an unauthenticated attacker crash or hang applications processing crafted XML. The issue affects System.Security.Cryptography.Xml, particularly EncryptedXml handling used in scenarios such as SAML assertions, WS-Security SOAP headers, and other encrypted XML endpoints exposed to untrusted networks. Malicious payloads with deeply nested encrypted elements, recursive structures, or abusive transform processing can trigger stack exhaustion, CPU starvation, or out-of-memory conditions; the vulnerability is tracked as CWE-770 and carries a CVSS 7.5 rating.
Microsoft's fix adds a default maximum recursion depth of 64 for recursive XML operations and blocks unsafe CipherReference transform methods unless an AppContext switch explicitly permits them. The runtime changes also cover decryption, canonicalization, signature computation, and signature verification paths, with tests for deep nesting, recursive encrypted payloads, infinite-loop XSLT, and expansion-style XSLT abuse. Organizations are advised to upgrade to patched .NET releases or update the System.Security.Cryptography.Xml NuGet package to prevent remote XML inputs from causing service disruption.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-50525 was publicly described as a high-severity denial-of-service vulnerability in Microsoft .NET's XML Cryptography stack, affecting System.Security.Cryptography.Xml and EncryptedXml processing. The disclosure states Microsoft addressed the issue by enforcing recursion-depth limits and restricting CipherReference transforms to a safe whitelist, and notes an NVD CVSS v3.1 score of 7.5.
A .NET runtime update introduced protections in System.Security.Cryptography.Xml, including a default maximum recursion depth of 64 and blocking unsafe encrypted XML transform methods unless explicitly allowed via an AppContext switch. The changes added tests for deep XML nesting, recursive encrypted payloads, and abusive XSLT scenarios tied to denial-of-service risk.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released security bulletin **MS13-002** to fix two privately reported remote code execution vulnerabilities in Microsoft XML Core Services (**MSXML**), tracked as `CVE-2013-0006` and `CVE-2013-0007`. The flaws could be triggered if a user visited a specially crafted webpage in Internet Explorer, allowing an attacker to run arbitrary code with the privileges of the logged-on user. Microsoft rated the issue **Critical** for affected client platforms and for **MSXML 5.0** components shipped with several Microsoft Office and server products, while most affected Windows Server systems were rated **Moderate** because of lower exposure. The update changes how MSXML parses XML content and Microsoft urged organizations to deploy it promptly through automatic updating or Microsoft Update. The company also said update `KB2687497` for SharePoint Server 2007 and Groove Server 2007 was rereleased as a new package and must be installed again even if the earlier `MS12-043` version was already present. Microsoft said the vulnerabilities had not been publicly disclosed and there was no evidence of active exploitation when the bulletin was originally issued.
Jun 29, 2026
Microsoft published security updates for a series of Windows elevation-of-privilege vulnerabilities affecting components including **Core Messaging**, **CSC Service**, **Cryptographic Services**, **Win32k**, and the **COM+ Event System Service**. The referenced flaws include `CVE-2025-21378`, `CVE-2025-21184`, `CVE-2025-21414`, `CVE-2025-26634`, `CVE-2025-49727`, `CVE-2025-58725`, and `CVE-2025-62458`, indicating a broad set of local privilege-escalation issues across core Windows subsystems. Among them, Microsoft provided additional detail for `CVE-2026-40377`, an **Important** vulnerability in Microsoft Cryptographic Services caused by a heap-based buffer overflow. Microsoft said a locally authorized attacker with low privileges could exploit the flaw to gain **SYSTEM** privileges without user interaction; the issue received a **CVSS 3.1 score of 7.8**, was assessed as **less likely** to be exploited, and was **not publicly disclosed or exploited** at the time of publication. Microsoft said a fix was available and credited **Bruce Dang of Calif.io** for reporting the bug.
Jul 12, 2026
Microsoft disclosed **CVE-2026-71328**, a high-severity remote code execution vulnerability in `Microsoft.DiaSymReader.Native`, a component used by .NET projects and Visual Studio to process debugging symbols. The flaw is a CWE-122 heap-based buffer overflow: a crafted MSFZ PDB file can trigger an out-of-bounds write during parsing, potentially allowing code execution. It carries a CVSS v3.1 score of 8.8 and affects specified package releases used across .NET 8, .NET 9, .NET 10, and .NET 11 RC1. Microsoft resolved the issue in `Microsoft.DiaSymReader.Native` version `18.9.0-beta1.26405.2` and advises organizations to install the relevant .NET or Visual Studio updates, update any direct package references, and restart affected applications. The cumulative .NET 10.0.12 servicing update includes security fixes and supersedes .NET 10.0.11; it is available through Microsoft Update, WSUS, and the Microsoft Update Catalog.
Sep 12, 2026