GDS-2026-0001: GDSLAB and GDSBES are not affected by eight vulnerabilities in the System.Security.Cryptography.Xml component

Advisory ID: GDS-2026-0001
Published: 21 Aug 2026
Last updated: 11 Sep 2026

Summary

GDSLAB 2026.07.17 ships the Microsoft NuGet component System.Security.Cryptography.Xml 9.0.3, and GDSBES v2026.03.25 ships version 9.0.9 of the same component through the shared licence library. Eight published vulnerabilities affect both of those component versions. All eight are in the component's XML encryption code, which neither product calls: the component is used only to verify the digital signature on a licence file. Neither product is affected by any of them. The component has been updated to 9.0.19 in both in any case, so that a scan of an installed product stops reporting a match. This advisory exists because a vulnerability scanner reading the files in an installation will flag the component version and cannot see which code paths we use.

Vulnerability 1 of 8

CVE: CVE-2026-33116
Weakness: CWE-20 Improper Input Validation; CWE-400 Uncontrolled Resource Consumption; CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Severity: High — CVSS v4.0 base score 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

An application that decrypts XML with EncryptedXml can be driven into an infinite loop by a crafted document, hanging the process until it is restarted.

Affected products

GDSLAB — via System.Security.Cryptography.Xml 9.0.3: Affected versions 2026.07.17. Not affected — the vulnerable code ships but is not in the execute path. GDSLAB ships this component but never constructs EncryptedXml, where the affected code lives. The component's only consumer in GDSLAB is SignedXml, which verifies the RSA signature on a licence file in LicenceHelpers.cs at lines 230 and 264, and the licence file is read from local disk rather than accepted over a network. XML encryption is a separate code path that GDSLAB does not enter.
GDSBES — via System.Security.Cryptography.Xml 9.0.9: Affected versions v2026.03.25. Not affected — the vulnerable code ships but is not in the execute path. GDSBES ships this component through the shared licence library in GDSFramework and never constructs EncryptedXml, where the affected code lives. The component's only consumer is the signature check on a licence file, and the licence file is read from local disk rather than accepted over a network. XML encryption is a separate code path that GDSBES does not enter.

Remediation

No action is required: neither GDSLAB 2026.07.17 nor GDSBES v2026.03.25 can reach the affected code. GDSLAB's copy has been updated from 9.0.3 to 9.0.19 under LAB-1014, and the shared GDSFramework library that GDSBES uses has been updated from 9.0.9 to 9.0.19, so that a scan of the installed files stops matching in either product. Both updates ship in the next release of the product concerned. Upstream fixed this in 9.0.15.

Vulnerability 2 of 8

CVE: CVE-2026-26171
Weakness: CWE-400 Uncontrolled Resource Consumption; CWE-611 Improper Restriction of XML External Entity Reference
Severity: High — CVSS v4.0 base score 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

An application that decrypts XML with EncryptedXml can be made to consume unbounded memory or CPU by a crafted document, including by resolving external entities, until the process is exhausted.

Affected products

GDSLAB — via System.Security.Cryptography.Xml 9.0.3: Affected versions 2026.07.17. Not affected — the vulnerable code ships but is not in the execute path. GDSLAB ships this component but never constructs EncryptedXml, where the affected code lives. The component's only consumer in GDSLAB is SignedXml, which verifies the RSA signature on a licence file in LicenceHelpers.cs at lines 230 and 264, and the licence file is read from local disk rather than accepted over a network. XML encryption is a separate code path that GDSLAB does not enter.
GDSBES — via System.Security.Cryptography.Xml 9.0.9: Affected versions v2026.03.25. Not affected — the vulnerable code ships but is not in the execute path. GDSBES ships this component through the shared licence library in GDSFramework and never constructs EncryptedXml, where the affected code lives. The component's only consumer is the signature check on a licence file, and the licence file is read from local disk rather than accepted over a network. XML encryption is a separate code path that GDSBES does not enter.

Remediation

Vulnerability 3 of 8

CVE: CVE-2026-32203
Weakness: CWE-20 Improper Input Validation; CWE-121 Stack-based Buffer Overflow; CWE-787 Out-of-bounds Write
Severity: High — CVSS v4.0 base score 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

A crafted document can make EncryptedXml write past the end of a stack buffer, crashing the process.

Affected products

GDSLAB — via System.Security.Cryptography.Xml 9.0.3: Affected versions 2026.07.17. Not affected — the vulnerable code ships but is not in the execute path. GDSLAB ships this component but never constructs EncryptedXml, where the affected code lives. The component's only consumer in GDSLAB is SignedXml, which verifies the RSA signature on a licence file in LicenceHelpers.cs at lines 230 and 264, and the licence file is read from local disk rather than accepted over a network. XML encryption is a separate code path that GDSLAB does not enter.
GDSBES — via System.Security.Cryptography.Xml 9.0.9: Affected versions v2026.03.25. Not affected — the vulnerable code ships but is not in the execute path. GDSBES ships this component through the shared licence library in GDSFramework and never constructs EncryptedXml, where the affected code lives. The component's only consumer is the signature check on a licence file, and the licence file is read from local disk rather than accepted over a network. XML encryption is a separate code path that GDSBES does not enter.

Remediation

Vulnerability 4 of 8

CVE: CVE-2026-47302
Weakness: CWE-770 Allocation of Resources Without Limits or Throttling
Severity: High — CVSS v4.0 base score 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

A crafted document can make.NET's XML encryption handling allocate without any limit, exhausting or crashing the process. This one also covers the.NET runtime's own XML processing, not only the NuGet package.

Affected products

GDSLAB — via System.Security.Cryptography.Xml 9.0.3: Affected versions 2026.07.17. Not affected — the vulnerable code ships but is not in the execute path. GDSLAB ships this component but never constructs EncryptedXml, and the affected code is in XML encryption handling. The component's only consumer in GDSLAB is SignedXml, verifying the RSA signature on a licence file in LicenceHelpers.cs at lines 230 and 264, from local disk rather than over a network. Note that this advisory also covers the.NET runtime's own XML processing, which is serviced by the installed.NET runtime and not by this package; the same reasoning applies, because GDSLAB reaches no XML decryption path at all.
GDSBES — via System.Security.Cryptography.Xml 9.0.9: Affected versions v2026.03.25. Not affected — the vulnerable code ships but is not in the execute path. GDSBES ships this component through the shared licence library in GDSFramework and never constructs EncryptedXml, where the affected code lives. The component's only consumer is the signature check on a licence file, and the licence file is read from local disk rather than accepted over a network. XML encryption is a separate code path that GDSBES does not enter.

Remediation

Vulnerability 5 of 8

CVE: CVE-2026-47304
Weakness: CWE-345 Insufficient Verification of Data Authenticity; CWE-347 Improper Verification of Cryptographic Signature
Severity: Critical — CVSS v4.0 base score 9.2

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Impact

An attacker can defeat the protection XML encryption is meant to provide and read data an application encrypted with EncryptedXml. Unlike the other seven this is a loss of confidentiality and integrity, not only of availability.

Affected products

GDSLAB — via System.Security.Cryptography.Xml 9.0.3: Affected versions 2026.07.17. Not affected — the vulnerable code ships but is not in the execute path. GDSLAB ships this component but never constructs EncryptedXml, where the affected code lives. The component's only consumer in GDSLAB is SignedXml, which verifies the RSA signature on a licence file in LicenceHelpers.cs at lines 230 and 264, and the licence file is read from local disk rather than accepted over a network. XML encryption is a separate code path that GDSLAB does not enter.
GDSBES — via System.Security.Cryptography.Xml 9.0.9: Affected versions v2026.03.25. Not affected — the vulnerable code ships but is not in the execute path. GDSBES ships this component through the shared licence library in GDSFramework and never constructs EncryptedXml, where the affected code lives. The component's only consumer is the signature check on a licence file, and the licence file is read from local disk rather than accepted over a network. XML encryption is a separate code path that GDSBES does not enter.

Remediation

Vulnerability 6 of 8

CVE: CVE-2026-50648
Weakness: CWE-770 Allocation of Resources Without Limits or Throttling
Severity: High — CVSS v4.0 base score 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

A crafted document can make EncryptedXml allocate resources without limit, exhausting the process.

Affected products

GDSLAB — via System.Security.Cryptography.Xml 9.0.3: Affected versions 2026.07.17. Not affected — the vulnerable code ships but is not in the execute path. GDSLAB ships this component but never constructs EncryptedXml, where the affected code lives. The component's only consumer in GDSLAB is SignedXml, which verifies the RSA signature on a licence file in LicenceHelpers.cs at lines 230 and 264, and the licence file is read from local disk rather than accepted over a network. XML encryption is a separate code path that GDSLAB does not enter.
GDSBES — via System.Security.Cryptography.Xml 9.0.9: Affected versions v2026.03.25. Not affected — the vulnerable code ships but is not in the execute path. GDSBES ships this component through the shared licence library in GDSFramework and never constructs EncryptedXml, where the affected code lives. The component's only consumer is the signature check on a licence file, and the licence file is read from local disk rather than accepted over a network. XML encryption is a separate code path that GDSBES does not enter.

Remediation

Vulnerability 7 of 8

CVE: CVE-2026-50525
Weakness: CWE-770 Allocation of Resources Without Limits or Throttling
Severity: High — CVSS v4.0 base score 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

A crafted document can make EncryptedXml allocate resources without limit, exhausting the process.

Affected products

GDSLAB — via System.Security.Cryptography.Xml 9.0.3: Affected versions 2026.07.17. Not affected — the vulnerable code ships but is not in the execute path. GDSLAB ships this component but never constructs EncryptedXml, where the affected code lives. The component's only consumer in GDSLAB is SignedXml, which verifies the RSA signature on a licence file in LicenceHelpers.cs at lines 230 and 264, and the licence file is read from local disk rather than accepted over a network. XML encryption is a separate code path that GDSLAB does not enter.
GDSBES — via System.Security.Cryptography.Xml 9.0.9: Affected versions v2026.03.25. Not affected — the vulnerable code ships but is not in the execute path. GDSBES ships this component through the shared licence library in GDSFramework and never constructs EncryptedXml, where the affected code lives. The component's only consumer is the signature check on a licence file, and the licence file is read from local disk rather than accepted over a network. XML encryption is a separate code path that GDSBES does not enter.

Remediation

Vulnerability 8 of 8

CVE: CVE-2026-50527
Weakness: CWE-121 Stack-based Buffer Overflow
Severity: High — CVSS v4.0 base score 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

A crafted document can overflow a stack buffer inside EncryptedXml, crashing the process.

Affected products

GDSLAB — via System.Security.Cryptography.Xml 9.0.3: Affected versions 2026.07.17. Not affected — the vulnerable code ships but is not in the execute path. GDSLAB ships this component but never constructs EncryptedXml, where the affected code lives. The component's only consumer in GDSLAB is SignedXml, which verifies the RSA signature on a licence file in LicenceHelpers.cs at lines 230 and 264, and the licence file is read from local disk rather than accepted over a network. XML encryption is a separate code path that GDSLAB does not enter.
GDSBES — via System.Security.Cryptography.Xml 9.0.9: Affected versions v2026.03.25. Not affected — the vulnerable code ships but is not in the execute path. GDSBES ships this component through the shared licence library in GDSFramework and never constructs EncryptedXml, where the affected code lives. The component's only consumer is the signature check on a licence file, and the licence file is read from local disk rather than accepted over a network. XML encryption is a separate code path that GDSBES does not enter.

Remediation

Security updates are free of charge for every user within the product's support period, whether or not you hold a support contract.

Revision history

21 Aug 2026: First published.
11 Sep 2026: Scope extended to GDSBES, which reaches the same component through the shared licence library in GDSFramework and ships version 9.0.9. GDSBES was not named when this advisory was first published. The assessment is unchanged: the affected code is not reached.

References

← All advisories