For Windows administrators, DevOps teams, and cross-platform software engineers maintaining web services and developer workstations, applying the corresponding runtime and IDE updates is essential to keep both production endpoints and build pipelines resilient against network-borne service disruption.
Vulnerability Overview and Technical Profile
At the core of CVE-2026-109478 is a weakness classified under CWE-407 (Inefficient Algorithmic Complexity). Microsoft's official description states: Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
From a general software engineering perspective, algorithmic complexity vulnerabilities occur when the worst-case execution time or resource consumption of an operation scales disproportionately with the size or structure of an input. When such logic sits in a network-accessible framework like ASP.NET Core, an attacker does not need valid credentials or local access to trigger the worst-case path; they only need to send specially structured network traffic that forces the host process to spend excessive processing cycles handling the request.
Microsoft rates the severity of CVE-2026-109478 as Important, assigning a CVSS base score of 7.5 and a CVSS temporal score of 6.5. The complete CVSS vector string is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Breaking down the vector components shows why this issue warrants prompt patching for internet-facing and internal services alike:
- Attack Vector (
AV:N) and Attack Complexity (AC:L): The flaw is exploitable over a network with low attack complexity. - Privileges Required (
PR:N) and User Interaction (UI:N): No authentication privileges or user interaction are needed for an unauthorized attacker to trigger the condition. - Scope and Impact (
S:U/C:N/I:N/A:H): While confidentiality and integrity are not impacted (C:N/I:N) and the scope remains unchanged (S:U), the availability impact is High (A:H), reflecting the ability to deny service completely to legitimate users. - Temporal Metrics (
E:U/RL:O/RC:C): The temporal score of 6.5 reflects unproven exploit maturity (E:U), the availability of an official remediation level (RL:O), and confirmed report confidence (RC:C).
Official MSRC Status Indicators
Microsoft's Security Response Center (MSRC) provides the following official status assessments for CVE-2026-109478:
Publicly disclosed: NoExploited: NoCustomer action required: Yes- Exploitation Assessment: Exploitation Less Likely
Section Summary: CVE-2026-109478 is an Important severity (7.5 base score, 6.5 temporal score) ASP.NET Core Denial of Service Vulnerability (CWE-407) that allows unauthenticated network attackers to disrupt availability without user interaction. While exploitation is assessed as less likely and the flaw has neither been publicly disclosed nor exploited, customer action is required to secure affected environments.
Affected Products, KB Articles, and Fixed Builds
Because ASP.NET Core is distributed both as a standalone runtime/SDK across Windows, Linux, and macOS and bundled inside integrated development environments, the patch footprint spans nine distinct product entries. Below is the complete breakdown of affected products, associated Knowledge Base articles, and vendor fixed builds from the official Microsoft advisory data:
| Affected Product | KB Article | Fixed Build |
|---|---|---|
| .NET 8.0 installed on Linux | KB5135243 | 8.0.34 |
| .NET 8.0 installed on Mac OS | KB5135243 | 8.0.34 |
| .NET 8.0 installed on Windows | KB5135243 | 8.0.34 |
| .NET 9.0 installed on Linux | — | 9.0.0-preview.4.24266.19 |
| .NET 9.0 installed on Mac OS | — | 9.0.0-preview.4.24266.19 |
| .NET 9.0 installed on Windows | — | 9.0.0-preview.4.24266.19 |
| Microsoft Visual Studio 2022 version 17.14 | — | 17.14.45 |
| Microsoft Visual Studio 2026 version 18.11 | — | 18.11.4 |
| Microsoft Visual Studio 2026 version 18.12 | — | 18.12.0 |
Exact Remediation Guidance
Administrators and developers must apply the exact updates corresponding to each deployed runtime and IDE instance:
- For .NET 8.0 installed on Linux, install KB5135243 to reach fixed build 8.0.34.
- For .NET 8.0 installed on Mac OS, install KB5135243 to reach fixed build 8.0.34.
- For .NET 8.0 installed on Windows, install KB5135243 to reach fixed build 8.0.34.
- For .NET 9.0 installed on Linux, update to fixed build 9.0.0-preview.4.24266.19 or later.
- For .NET 9.0 installed on Mac OS, update to fixed build 9.0.0-preview.4.24266.19 or later.
- For .NET 9.0 installed on Windows, update to fixed build 9.0.0-preview.4.24266.19 or later.
- For Microsoft Visual Studio 2022 version 17.14, update to fixed build 17.14.45 or later.
- For Microsoft Visual Studio 2026 version 18.11, update to fixed build 18.11.4 or later.
- For Microsoft Visual Studio 2026 version 18.12, update to fixed build 18.12.0 or later.
Section Summary: Remediating CVE-2026-109478 requires installing KB5135243 to reach fixed build 8.0.34 for .NET 8.0 installed on Linux, .NET 8.0 installed on Mac OS, and .NET 8.0 installed on Windows; updating .NET 9.0 installed on Linux, .NET 9.0 installed on Mac OS, and .NET 9.0 installed on Windows to fixed build 9.0.0-preview.4.24266.19 or later; and updating Microsoft Visual Studio 2022 version 17.14 to 17.14.45 or later, Microsoft Visual Studio 2026 version 18.11 to 18.11.4 or later, and Microsoft Visual Studio 2026 version 18.12 to 18.12.0 or later.
Practical Guidance for IT Administrators and Developers
Why do Visual Studio installations appear alongside production .NET runtimes in a network denial-of-service advisory? Based on general industry knowledge of the .NET ecosystem, Visual Studio bundles SDKs, targeting packs, and local development server components—and build agents or developer workstations can also package self-contained deployments using the locally installed SDK. If a build server or developer machine compiles and ships a self-contained ASP.NET Core application using an unpatched SDK or runtime package, the resulting deployment can carry the vulnerable libraries into production even if the target host OS has no shared runtime installed.
To ensure thorough remediation across your environment:
- Audit Installed .NET Runtimes and SDKs: Run
dotnet --infoon Windows, Linux, and macOS hosts to inventory active runtime and SDK versions, verifying that .NET 8.0 installations have reached 8.0.34 via KB5135243 and .NET 9.0 installations have reached 9.0.0-preview.4.24266.19 or later. - Update Developer Workstations and Build Servers: Use the Visual Studio Installer or enterprise deployment tools to bring Microsoft Visual Studio 2022 version 17.14 to 17.14.45 or later, Microsoft Visual Studio 2026 version 18.11 to 18.11.4 or later, and Microsoft Visual Studio 2026 version 18.12 to 18.12.0 or later.
- Rebuild and Redeploy Self-Contained Applications: If your organization distributes self-contained ASP.NET Core applications or container images, rebuild and redeploy those workloads after patching your build environments so they incorporate the updated runtime binaries.
Section Summary: Securing your infrastructure against CVE-2026-109478 requires patching both live server runtimes and the Visual Studio development and build environments that compile and package ASP.NET Core applications.