CVE-2026-33116: microsoft microsoft .net framework 3.5 Infinite Loop

Vulnerability summary

CVE-2026-33116 is a high (CVSS 7.5) Infinite Loop vulnerability in microsoft microsoft .net framework 3.5. EPSS estimates a 2.44% chance of exploitation in the next 30 days, higher than 84.1% of scored vulnerabilities.

Timeline

1. 14-04-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.

• CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.