Log in Start free

Vulnerability · Published Jun 14, 2023 · Assigned by microsoft

CVE-2023-24897.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

High 7.8

In plain English

A high-severity heap buffer overflow in Microsoft .NET Framework 3.5 and 4.6.2 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)1.2%top 32.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20dotnet6-build6.0.118-r0ALPINE-CVE-2023-24897
Alpine:v3.20dotnet6-runtime6.0.18-r0ALPINE-CVE-2023-24897
NuGetmicrosoft.netcore.app.runtime.win-arm6.0.18GHSA-88q2-h5g3-p4pg
NuGetmicrosoft.netcore.app.runtime.win-arm7.0.7GHSA-88q2-h5g3-p4pg
NuGetmicrosoft.netcore.app.runtime.win-arm646.0.18GHSA-88q2-h5g3-p4pg
NuGetmicrosoft.netcore.app.runtime.win-arm647.0.7GHSA-88q2-h5g3-p4pg
NuGetmicrosoft.netcore.app.runtime.win-x647.0.7GHSA-88q2-h5g3-p4pg
NuGetmicrosoft.netcore.app.runtime.win-x646.0.18GHSA-88q2-h5g3-p4pg
NuGetmicrosoft.netcore.app.runtime.win-x866.0.18GHSA-88q2-h5g3-p4pg
NuGetmicrosoft.netcore.app.runtime.win-x867.0.7GHSA-88q2-h5g3-p4pg

Affected products (as reported)

VendorProductVersions
Microsoft Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) 15.9.0 – before 15.9.55
Microsoft Microsoft Visual Studio 2022 version 17.2 17.2.0 – before 17.2.16
Microsoft Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) 16.11.0 – before 16.11.27
Microsoft Microsoft Visual Studio 2022 version 17.0 17.0.0 – before 17.0.22
Microsoft Microsoft Visual Studio 2022 version 17.4 17.4.0 – before 17.4.8
Microsoft Microsoft Visual Studio 2013 Update 5 12.0.0 – before 12.0.40700.0
Microsoft Microsoft Visual Studio 2015 Update 3 14.0.0 – before 14.0.27555.0
Microsoft .NET 7.0 7.0.0 – before 7.0.7
Microsoft .NET 6.0 6.0.0 – before 6.0.18
Microsoft Microsoft Visual Studio 2022 version 17.6 17.6.0 – before 17.6.3
Microsoft PowerShell 7.2 7.2.0 – before 7.2.12
Microsoft Microsoft .NET Framework 3.5 AND 4.8 4.8.0 – before 4.8.4644.0
Microsoft Microsoft .NET Framework 4.8 4.8.0 – before 4.8.4644.0
Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 4.7.0 – before 4.7.4050.0
Microsoft Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 3.0.0.0 – before 10.0.14393.5989
Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.0 – before 4.7.04043.0
Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1 – before 4.8.9166.0
Microsoft Microsoft .NET Framework 4.6.2 4.7.0 – before 4.7.04043.0
Microsoft Microsoft .NET Framework 3.5 and 4.6.2 4.7.0 – before 10.0.10240.19983

Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

References