CVE-2026-62901

Think of your .NET app as following a set of instructions (a loop). This bug lets an attacker feed in weird data so the instructions can repeat far too long (or endlessly), which can freeze or crash the app. The result is downtime—your customers may see errors or timeouts.

This matters if your business runs or builds software using .NET 8.0, .NET 9.0, or .NET 10.0, or you rely on the specific Microsoft Visual Studio 2022/2026 versions listed. Because the issue is reachable over the network with no login and no user action, it’s most relevant for any service that accepts network requests and processes attacker-controlled data.

It’s a risk when an attacker can send data to a network endpoint that your .NET code processes (it’s reachable in default configuration).

Red: attackers can trigger this remotely without logins, and it can stop the .NET system from working via an infinite or excessive loop. That makes it directly useful for causing downtime. Even without confirmed public exploit code, the impact is immediate when the vulnerable code path is reachable over the network, so you should patch on an urgent schedule.