CVE-2026-50648: microsoft microsoft .net framework 3.5
CVSS: 7.5v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-50648CGA-25m8-5c9g-5pm5CGA-2992-2c2c-c6rgCGA-2f59-2x4x-r4c7CGA-2q52-x288-pm28CGA-37pg-gm3v-m8cqCGA-388g-h224-5fwpCGA-394w-jwmr-gpfwCGA-3x7g-r3gx-f4m2CGA-42rh-px3p-wf26CGA-45f7-w6m7-q36pCGA-47hw-rr4x-39qjCGA-4mmw-ww79-cm5jCGA-52jj-vqxf-rcp2CGA-53w7-5gx5-7p89CGA-57rf-mmhf-r45rCGA-57xf-c89r-hp5rCGA-582w-86j3-fhv5CGA-5h6g-cwqw-24pxCGA-5jrc-jfjq-799vCGA-5pr9-x7xv-mcrpCGA-642m-pm6g-9422CGA-6hqf-wjg8-6gx3CGA-75w9-m9gr-2488CGA-773p-p8h4-g2xqCGA-7756-fhp2-5wqvCGA-7j27-pwmj-53q5CGA-7qc6-pf77-wjxhCGA-7x7q-pp26-8gwvCGA-85h7-839r-xvwcCGA-8929-8pcx-9g6vCGA-8g5x-rm8v-gvcqCGA-8m5j-h5f2-x9vrCGA-8p89-6vm4-9q66CGA-92h6-qwq6-mf88CGA-9443-2mhh-gqmrCGA-97j8-3953-rj89CGA-9m79-74mm-hm4wCGA-9r66-9vv4-x93fCGA-9xcp-wvgh-7mp3CGA-c7w3-jfj2-4xwmCGA-cj9m-9h5w-jpg3CGA-cmwm-vhjw-g32vCGA-f3qg-6ch5-vr8cCGA-fg4f-479m-62fhCGA-fmj9-x73m-cg86CGA-fp8x-rw6v-gc8mCGA-gcwf-46qv-786qCGA-gqpj-84fj-58hmCGA-grh2-85gc-jg37CGA-gwx5-8qrc-ww43CGA-h2hg-pjwp-7px4CGA-h8gw-q7hp-g8cqCGA-hc69-j95v-jjwwCGA-hgjg-75gc-pr7cCGA-hh3p-jh2r-pqp8CGA-hhc6-r3jh-fx8fCGA-j7wq-2g4v-p254CGA-jj3r-ww9j-fg42CGA-m3q7-3fm9-j3j6CGA-p587-6cff-9cxvCGA-pg7w-j4wq-x4j9CGA-pj93-qmpp-pgxpCGA-pjp4-x5cr-qr7qCGA-qfq2-rfgq-rv2cCGA-qpfj-24j2-xhjwCGA-qwm5-jp6j-2828CGA-r6vm-966h-696jCGA-r7jw-23c3-jvp3CGA-rc59-xcm6-2hp3CGA-rwf2-2fmc-9j76CGA-rwpf-89jh-78q2CGA-vh3p-qw5x-m3wpCGA-x77w-3xq3-788cCGA-x8fj-m37q-8m73CGA-xx53-fr3m-8j35GHSA-23rf-6693-g89pBIT-dotnet-2026-50648BIT-dotnet-sdk-2026-50648
Published 14-07-2026Last modified 08-10-2026
Vulnerability summary
CVE-2026-50648 is a high (CVSS 7.5) vulnerability in microsoft microsoft .net framework 3.5. EPSS estimates a 1.17% chance of exploitation in the next 30 days, higher than 67% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
1.17%
0%100%
Low · +0.33 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 17 · Related 2Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:CSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NugetEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.17%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
+0.33 pp
From 0.84% on 19-09-2026
19-09-202619-10-2026
EPSS score1.17%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Microsoft16 products
- microsoft .net framework 3.5≥ 3.5.0, < 2.0.50727.8983 & 3.0.30729.8978
- microsoft .net framework 3.5 and 4.7.2≥ 4.7.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0
- microsoft .net framework 3.5 and 4.8≥ 4.8.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0
- microsoft .net framework 3.5 and 4.8.1≥ 4.8.1, < 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
- microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2≥ 4.7.0, < 4.7.4143.0
Chainguard8 products
- aspnet-8-targeting-pack< 8.0.131-r0
- dotnet-8-sdk< 8.0.129-r1
- dotnet-bootstrap-8< 8.0.129-r0 | < 8.0.130-r0
- dotnet-bootstrap-9< 9.0.120-r0
- dotnet-sdk-10.0.2< 10.0.204-r4
Wolfi8 products
- aspnet-8-targeting-pack< 8.0.131-r0
- dotnet-8-sdk< 8.0.129-r1
- dotnet-bootstrap-8< 8.0.129-r0 | < 8.0.130-r0
- dotnet-bootstrap-9< 9.0.120-r0
- dotnet-sdk-10.0.2< 10.0.204-r4
Ubuntu4 products
- dotnet10< 10.0.110-10.0.10-0ubuntu1~24.04.1 | < 10.0.110-10.0.10-0ubuntu1~26.04.1
- dotnet6All versions (No fix recorded)
- dotnet7All versions (No fix recorded)
- dotnet8< 8.0.129-8.0.29-0ubuntu1~22.04.1 | < 8.0.129-8.0.29-0ubuntu1~24.04.1
NuGet1 product
- System.Security.Cryptography.Xml≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.4
5 vendors · 37 products
References
10 links
- github.com/dotnet/runtimePACKAGE