CVE-2026-33116

HighCVSS 7.5/10Last modified Jul 25, 2026

Description

Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20CWE-400CWE-835CWE-776

Affected software

VendorProductVersions
Microsoft.NET 10.0>= 10.0.0, < 10.0.6
Microsoft.NET 8.0>= 8.0, < 8.0.26
Microsoft.NET 8.0>= 8.0.0, < 8.0.26
Microsoft.NET 9.0>= 9.0.0, < 9.0.15
MicrosoftMicrosoft .NET Framework 3.5>= 3.5.0, < 2.0.50727.8982 & 3.0.30729.8976
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2>= 4.7.0, < 2.0.50727.9068 & 3.0.30729.9065 & 4.7.4141.0
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8>= 4.8.0, < 2.0.50727.9068 & 3.0.30729.9065 & 4.8.4801.0
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8.1>= 4.8.1, < 2.0.50727.9181 & 3.0.30729.9165 & 4.8.9332.0
MicrosoftMicrosoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2>= 4.7.0, < 4.8.4801.0
MicrosoftMicrosoft .NET Framework 4.8>= 4.8.0, < 4.8.4801.0
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Hardened Images—
Red HatRed Hat Hardened Images—
Red HatRed Hat Hardened Images—

References

Timeline

Published
Apr 14, 2026
Last modified
Jul 25, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-331179.1The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authenticatioCVE-2026-331184.3User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform CVE-2026-331195.4User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform CVE-2026-331208.8Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-331218.8DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in thCVE-2026-331229.8DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in thCVE-2026-331236.5pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to lCVE-2026-331248.8Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Versions prior to 0.17.0-beta1 allow any authCVE-2026-331258.1Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the CVE-2026-331264.3Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoinCVE-2026-3312810.0H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to ServCVE-2026-331295.9H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 through 2.0.0-rc.8 contain a Timing Side-Channel vulnerability in the requireBasicAu
CVE-2026-33116: High severity, CVSS 7.5 | Vulnix