CVE‑2026‑84008 System.Security.Cryptography.Pkcs 9.0.0 Vulnerability in C1.Pdf

Microsoft’s security advisory identifies an issue in SignedCms.CheckSignature where attacker-controlled X.509 certificate data can be repeatedly reparsed, resulting in unauthenticated quadratic CPU exhaustion.

• CWE: CWE-407 — Inefficient Algorithmic Complexity
• CVSS 3.1: 7.5 (High) — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: Microsoft Security Advisory CVE-2026-84008 | .NET Denial of Service Vulnerability · Issue #468 · dotnet/announcements

Affected Components, Impact and Resolution

Affected Components: 

• C1.Pdf (NuGet Gallery | C1.Pdf 10.0.20261.290). C1.Pdf's dependency chain includes System.Security.Cryptography.Pkcs 9.0.18, which is within the vulnerable range (9.0.0 ≤ v < 9.0.21). This means any application using C1.Pdf without upgrading will be exposed to CVE‑2026‑84008.
• Affected versions: 8.0.20242.105 - 10.020261.290.
• This includes other packages that transitively depend on C1.Pdf including:
  • C1.Document
  • C1.Win.Document
  • C1.Win.FlexViewer
  • C1.WPF.Document
  • C1.WPF.Viewer
  • C1.Xaml.WPF.FlexViewer
  • C1.WinUI.Viewer
  • C1.MAUI.Viewer
  • C1.Blazor.Viewer

Affected platforms: Windows, Linux, and macOS across all architectures.

Impact: An attacker could exhaust CPU resources on the verifying host by submitting a signed message containing a large number of embedded certificates.

Resolution: In ComponentOne 2026 v2, we updated the affected dependency to resolve the vulnerability. Developers using earlier versions of C1.Pdf are encouraged to upgrade to 2026 v2 or later

Resolved version: 10.0.20262.331 (C1.Pdf 10.0.20262.331)