Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

• system.security.cryptography.pkcs · nuget.org

Timeline

Detection, updates, and resolution for this record.

1. Oct 13, 2026 · GitLab Advisory Database

   Detected

   Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. On Windows, EnvelopedCms.Decode can perform quadratic work while processing attacker-supplied CMS or PKCS#7 attributes, causing pre-authentication CP

Affected

• nuget system.security.cryptography.pkcsversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-70162

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-70162

  30-day exploitation probability 0.8%

  first.org
• GitLab Advisory DatabasePackage advisoryCVE-2026-70162

  Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. On Windows, EnvelopedCms.Decode can perform quadratic work while processing attacker-supplied CMS or PKCS#7 attributes, causing pre-authentication CP

  advisories.gitlab.com