| CVE Number | Vulnerability | Product | Severity | Date |
|---|---|---|---|---|
| CVE-2026-92707 | MessagePack-CSharp Denial of Service Vulnerability | Microsoft Visual Studio, Microsoft Edge, .NET Framework | Medium | 03-11-2026 |
Technical Information
An unauthenticated attacker could exploit improper control of sequential memory allocation by sending specially crafted network requests that trigger excessive memory allocation, exhausting system resources and causing a denial of service.
Patch release date: Oct 13, 2026
Further information on this vulnerability is available at : CVE-2026-92707
Affected Software
System.Formats.Cbor on .NET 10.0 runtime installed on Windows,System.Formats.Cbor on .NET 10.0 runtime installed on Linux,
System.Formats.Cbor on .NET 10.0 runtime installed on Mac OS,
Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 11.0 runtime installed on Windows,
Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 11.0 runtime installed on Linux,
Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 11.0 runtime installed on Mac OS,
System.Formats.Cbor on .NET 8.0 runtime installed on Windows,
System.Formats.Cbor on .NET 8.0 runtime installed on Linux,
System.Formats.Cbor on .NET 8.0 runtime installed on Mac OS,
System.Formats.Cbor on .NET 9.0 runtime installed on Windows,
System.Formats.Cbor on .NET 9.0 runtime installed on Linux,
System.Formats.Cbor on .NET 9.0 runtime installed on Mac OS,
Microsoft Visual Studio 2026 version 18.10,
Microsoft Visual Studio 2022 version 17.14,
Microsoft Edge (Chromium-based)