The affected-product entries cover .NET installations on Windows, Linux and Mac OS, as well as System.Text.Json. Microsoft lists 11.0.0 as the fixed build for each.
Severity and assessment
- CVSS base score: 5.3
- CVSS temporal score: 4.6
- CVSS vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C - Weakness: CWE-407
- Exploitation assessment: Exploitation Less Likely
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
The vector describes a network attack requiring neither privileges nor user interaction, with a low impact on availability. Its confidentiality and integrity impact ratings are both none. That distinction matters when prioritizing the issue: the stated risk is service disruption, not a finding that the vulnerability exposes or modifies data.
What administrators and developers should do
Microsoft’s affected-product guidance is:
- For .NET 11.0 installed on Linux, update to fixed build 11.0.0 or later.
- For .NET 11.0 installed on Mac OS, update to fixed build 11.0.0 or later.
- For .NET 11.0 installed on Windows, update to fixed build 11.0.0 or later.
- For System.Text.Json, update to fixed build 11.0.0 or later.
For a practical inventory, teams should check both deployed .NET installations and applications that use System.Text.Json against those entries. A network-facing application deserves attention because the advisory describes a network-accessible denial-of-service risk; apply the relevant fix and verify the deployed version afterward.
The “Exploitation Less Likely” assessment provides useful prioritization context, but it does not replace Microsoft’s stated customer action: update the affected product to the fixed build or later.