Microsoft patches .NET 8-11 Pkcs flaw causing unauthenticated CPU exhaustion via malformed X.509 data

Microsoft has published security updates for the System.Security.Cryptography.Pkcs NuGet package to resolve a high-severity denial of service vulnerability. The issue stems from inefficient algorithmic complexity within the library, specifically affecting how it processes cryptographic signatures. This flaw impacts applications running on Windows, Linux, and macOS across all architectures, exposing any service that relies on the affected package versions to potential disruption.

Root cause

The vulnerability arises because the `SignedCms.CheckSignature` method can repeatedly reparse attacker-controlled X.509 data. This behaviour leads to unauthenticated quadratic CPU exhaustion. The Microsoft Security Update Guide classifies the issue as CWE-407, noting that the inefficient processing allows an unauthorized attacker to deny service over a network. The excessive computational load consumes system resources, potentially rendering the application unresponsive to legitimate requests.

Attack path

An attacker does not need authentication to exploit this flaw. By sending carefully crafted X.509 data to a service using the vulnerable `System.Security.Cryptography.Pkcs` package, they can trigger the repeated reparsing loop. The CVSS vector `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` confirms that the attack is network-accessible with low complexity and no privileges required. The impact is limited to availability, as confidentiality and integrity remain unaffected by this specific mechanism.

Affected versions

• Version 8.0.0 through 8.0.1 are vulnerable; patched in 8.0.2.
• Version 9.0.0 through 9.0.20 are vulnerable; patched in 9.0.21.
• Version 10.0.0 through 10.0.12 are vulnerable; patched in 10.0.13.
• Version 11.0.0-preview.1 through 11.0.0-rc.1 are vulnerable; patched in 11.0.0-rc.2.

Mitigation

• Upgrade `System.Security.Cryptography.Pkcs` to version 8.0.2 or later for .NET 8 projects.
• Upgrade `System.Security.Cryptography.Pkcs` to version 9.0.21 or later for .NET 9 projects.
• Upgrade `System.Security.Cryptography.Pkcs` to version 10.0.13 or later for .NET 10 projects.
• Upgrade `System.Security.Cryptography.Pkcs` to version 11.0.0-rc.2 or later for .NET 11 previews.

What it means for organisations

Security teams should immediately verify which applications depend on the affected `System.Security.Cryptography.Pkcs` versions. Infrastructure managers need to assess the exposure of public-facing services that process external certificates. Development leads must coordinate with internal teams to prioritise patching based on service criticality. Operations staff should monitor CPU usage metrics for unusual spikes that might indicate exploitation attempts. Vendor risk teams should confirm that third-party suppliers have also updated their .NET dependencies.

What to do and how to stay safe: Microsoft

• Audit your NuGet package dependencies to identify any usage of the vulnerable `System.Security.Cryptography.Pkcs` versions.
• Review application logs for signs of excessive CPU consumption or slow response times during certificate validation.
• Plan and execute updates to the patched versions during a maintenance window to minimise service disruption.
• Monitor network traffic for anomalous patterns that could indicate attempts to trigger the reparsing loop.

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-84008?

The CVSS 3.1 score is 7.5, rated as High severity.

Does this vulnerability affect confidentiality or integrity?

No, the impact is limited to availability, with no effect on confidentiality or integrity.

Which platforms are affected by this denial of service flaw?

The vulnerability affects Windows, Linux, and macOS across all architectures.