CVE-2026-84008

Name of the Vulnerable Software and Affected Versions System.Security.Cryptography.Pkcs versions 10.0.0 through 10.0.12 System.Security.Cryptography.Pkcs versions 11.0.0-preview.1 through 11.0.0-rc.1 System.Security.Cryptography.Pkcs versions 8.0.0 through 8.0.1 System.Security.Cryptography.Pkcs versions 9.0.0 through 9.0.20

Description Inefficient algorithmic complexity in .NET allows an unauthorized attacker to cause a denial of service over a network. Specifically, the SignedCms.CheckSignature() function can repeatedly reparse attacker-controlled X.509 data, leading to unauthenticated quadratic CPU exhaustion.

Recommendations Update System.Security.Cryptography.Pkcs versions 10.0.0 through 10.0.12 to version 10.0.13. Update System.Security.Cryptography.Pkcs versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2. Update System.Security.Cryptography.Pkcs versions 8.0.0 through 8.0.1 to version 8.0.2. Update System.Security.Cryptography.Pkcs versions 9.0.0 through 9.0.20 to version 9.0.21. As a temporary mitigation, restrict the use of the SignedCms.CheckSignature() function when processing untrusted X.509 data.