OnlyFm252
.NET Framework

CVE-2026-32226 — .NET Framework Denial of Service Vulnerability

Important CVSS 5.9 EPSS 0.00542 2026-04 archive

Executive Summary

Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network.

Overview

5.9
CVSS MEDIUM
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Denial of Service
Released Apr 14 2026
Last Updated Apr 14 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00542 — 0.41195 percentile
NVD CVSS 5.9 MEDIUM — matches MSRC

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Network
ATTACK COMPLEXITY
High
PRIVILEGES REQUIRED
None
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
None
INTEGRITY
None
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 5.2

EPSS Score

0.00542
probability of exploitation in the next 30 days
0.41195 percentile - updated 2026-06-21
View on FIRST.org

Affected Products

14 affected products
Product KB Article Severity Impact Restart Required
Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for ARM64-based Systems 5082413 (Security Update) Important Denial of Service Maybe
Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for x64-based Systems 5082413 (Security Update) Important Denial of Service Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for 32-bit Systems 5082414 (Security Update) Important Denial of Service Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for ARM64-based Systems 5082414 (Security Update) Important Denial of Service Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for x64-based Systems 5082414 (Security Update) Important Denial of Service Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows Server, version 20H2 (Server Core Installation) 5082426 (Security Update) Important Denial of Service Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 26H1 for ARM64-based Systems 5082421 (Security Update) Important Denial of Service Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H1 for x64-based Systems 5082421 (Security Update) Important Denial of Service Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025 5082417 (Security Update) Important Denial of Service Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025 (Server Core installation) 5082417 (Security Update) Important Denial of Service Maybe
Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for x64-based Systems 5082411 (Security Update) Important Denial of Service Maybe
Microsoft .NET Framework 4.8 on Windows Server 2012 (Server Core installation) 5082403 (Security Update) Important Denial of Service Maybe
Microsoft .NET Framework 4.8 on Windows Server 2012 R2 5082404 (Security Update) Important Denial of Service Maybe
Microsoft .NET Framework 4.8 on Windows Server 2012 R2 (Server Core installation) 5082411 (Security Update) Important Denial of Service Maybe

Patches

8 patches
Article Type Restart
5082413 Security Update Maybe
5082414 Security Update Maybe
5082426 Security Update Maybe
5082421 Security Update Maybe
5082417 Security Update Maybe
5082411 Security Update Maybe
5082403 Security Update Maybe
5082404 Security Update Maybe

Known Exploits

Acknowledgments

Anonymous

On This Page