CVE-2026-70162

Name of the Vulnerable Software and Affected Versions System.Security.Cryptography.Pkcs versions 10.0.0 through 10.0.12 System.Security.Cryptography.Pkcs versions 11.0.0-preview.1 through 11.0.0-rc.1 System.Security.Cryptography.Pkcs versions 8.0.0 through 8.0.1 System.Security.Cryptography.Pkcs versions 9.0.0 through 9.0.20

Description A denial of service issue exists in the Microsoft Common Object Runtime Library when handling web requests. On Windows, the EnvelopedCms.Decode() function can perform quadratic work while processing attacker-supplied CMS or PKCS#7 attributes, leading to pre-authentication CPU exhaustion. A remote unauthenticated attacker can exploit this by sending specially crafted requests to a .NET web application.

Recommendations Update System.Security.Cryptography.Pkcs version 10.0.0 through 10.0.12 to version 10.0.13. Update System.Security.Cryptography.Pkcs version 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2. Update System.Security.Cryptography.Pkcs version 8.0.0 through 8.0.1 to version 8.0.2. Update System.Security.Cryptography.Pkcs version 9.0.0 through 9.0.20 to version 9.0.21. Install the latest version of .NET and restart applications. Recompile and redeploy any self-contained applications targeting the affected versions.