CVE-2026-21218

Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.

Scoring

Severity

HIGH

CVSS base score

7.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C

EPSS probability

1.03%

CWE

CWE-166

Published

2026-02-10

Last modified

2026-08-19

Affected products

• Microsoft .NET 10.0
• Microsoft .NET 8.0
• Microsoft .NET 9.0

Weakness type

• CWE-166

Related vulnerabilities

• CVE-2026-32792 — Packet of death with DNSCrypt
• CVE-2024-38091 — Microsoft WS-Discovery Denial of Service Vulnerability

Markdown version · Browse all CVEs