CVE-2026-58280
Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability
Published Oct 13, 2026
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml and System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · GitLab Advisory Database
Detected
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml and System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bo
Affected
- nuget microsoft.netcore.app.runtime.linux-armversion unspecified
- nuget microsoft.netcore.app.runtime.linux-arm64version unspecified
- nuget microsoft.netcore.app.runtime.linux-musl-armversion unspecified
- nuget microsoft.netcore.app.runtime.linux-musl-arm64version unspecified
- nuget microsoft.netcore.app.runtime.linux-musl-x64version unspecified
- nuget microsoft.netcore.app.runtime.linux-x64version unspecified
- nuget microsoft.netcore.app.runtime.osx-arm64version unspecified
- nuget microsoft.netcore.app.runtime.osx-x64version unspecified
- nuget microsoft.netcore.app.runtime.win-armversion unspecified
- nuget microsoft.netcore.app.runtime.win-arm64version unspecified
- nuget microsoft.netcore.app.runtime.win-x64version unspecified
- nuget microsoft.netcore.app.runtime.win-x86version unspecified
Sources
- CVE.orgCVE-2026-58280
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-58280
30-day exploitation probability 1.1%
first.org - GitLab Advisory DatabaseCVE-2026-58280
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml and System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bo
advisories.gitlab.com