CVE-2026-32203

Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability

Published

2026-07-28

Modified

2026-07-28

EPSS percentile

73%

Aliases

GHSA-6588-8gv4-xfgh

Sources

github-advisory

Summary

## Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in EncryptedXml class where a buffer overflow can give an attacker to the ability to perform a Denial of Service attack. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/391 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 - **Vector:** 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H E:U/RL:O/RC:C - **Weakness:** CWE-121 CWE-20: Stack-based Buffer Overflow Improper Input Validation ## Affected Platforms - **Platforms:** All - **Architectures:** All ## Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected packages versions listed below ### .NET 10 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.xml) | >=10.0.0, .NET 9 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.xml) | >=9.0.0, .NET 8 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.xml) | >=8.0.0, How do I know if I am affected? If using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability. ### How do I fix the issue? To update the Using the System.Security.Cryptography.xml NuGet package, use one of the following methods: NuGet Package Manager UI in Visual Studio: - Open your project in Visual Studio. - Right-click on your project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages". - In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from your configured package sources. - Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version. - Click the "Update" button. Using the NuGet Package Manager Console in Visual Studio: - Open your project in Visual Studio. - Navigate to "Tools > NuGet Package Manager > Package Manager Console". - To update a specific package to its latest version, use the following Update-Package command: ```Update-Package -Id System.Security.Cryptography.Xml``` Using the .NET CLI (Command Line Interface): - Open a terminal or command prompt in your project's directory. - To update a specific package to its latest version, use the following add package command: ```dotnet add package System.Security.Cryptography.Xml``` Once you have updated the nuget package reference you must recompile and deploy your application. Additionally we recommend you update your runtime and/or SDKs, but it is not necessary to patch the vulnerability. ## Other Information ### Reporting Security Issues If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue). Security reports made through MSRC may qualif

Affected packages

Remediation: Upgrade to 10.0.6 or later.

References

• https://github.com/advisories/GHSA-6588-8gv4-xfgh