CVE-2026-96233

Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.

This vulnerability is rated as Important severity because an unauthenticated remote attacker can crash .NET applications and ASP.NET Core services by supplying malformed date strings, resulting in process termination and a complete denial of service. The flaw is exposed in applications that accept and parse user-controlled date or time values supporting Hebrew calendar formatting. While the flaw can be triggered remotely without privileges, it cannot be leveraged for arbitrary code execution or data disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.