CVE-2026-84008

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. `SignedCms.CheckSignature` can repeatedly reparse attacker-controlled X.509 data, causing unauthenticated quadratic CPU exhaustion. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/468 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` - **Weakness:** CWE-407 (Inefficient Algorithmic Complexity) ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## <a name="affected-packages"></a>Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 10.0.0, <= 10.0.12 | 10.0.13 [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 8.0.0, <= 8.0.1 | 8.0.2 [System.Security.Cryptography.Pkcs](https://www.nuget.org/packages/System.Security.Cryptography.Pkcs) | >= 9.0.0, <= 9.0.20 | 9.0.21 ## Advisory FAQ ### <a name="how-affected"></a>How do I know if I am affected? If using a package listed in [affected packages](#affected-packages), you're exposed to the vulnerability. ### <a name="how-fix"></a>How do I fix the issue? 1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio