Log in Start free

Vulnerability · Published Apr 9, 2024 · Assigned by microsoft

CVE-2024-21409.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

High 7.3

In plain English

A high-severity use-after-free in Microsoft .NET Framework 3.5 AND 4.7.2 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)2.5%top 15.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20dotnet6-build6.0.129-r0ALPINE-CVE-2024-21409
Alpine:v3.20dotnet6-runtime6.0.29-r0ALPINE-CVE-2024-21409
Alpine:v3.20dotnet8-runtime8.0.4-r0ALPINE-CVE-2024-21409
Alpine:v3.21dotnet8-runtime8.0.4-r0ALPINE-CVE-2024-21409
Alpine:v3.22dotnet8-runtime8.0.4-r0ALPINE-CVE-2024-21409
Alpine:v3.23dotnet8-runtime8.0.4-r0ALPINE-CVE-2024-21409
Alpine:v3.24dotnet8-runtime8.0.4-r0ALPINE-CVE-2024-21409
NuGetmicrosoft.windowsdesktop.app.runtime.win-arm646.0.29GHSA-6qmx-42h2-j8h6
NuGetmicrosoft.windowsdesktop.app.runtime.win-arm648.0.4GHSA-6qmx-42h2-j8h6
NuGetmicrosoft.windowsdesktop.app.runtime.win-arm647.0.18GHSA-6qmx-42h2-j8h6
NuGetmicrosoft.windowsdesktop.app.runtime.win-x646.0.29GHSA-6qmx-42h2-j8h6
NuGetmicrosoft.windowsdesktop.app.runtime.win-x648.0.4GHSA-6qmx-42h2-j8h6
NuGetmicrosoft.windowsdesktop.app.runtime.win-x647.0.18GHSA-6qmx-42h2-j8h6
NuGetmicrosoft.windowsdesktop.app.runtime.win-x867.0.18GHSA-6qmx-42h2-j8h6
NuGetmicrosoft.windowsdesktop.app.runtime.win-x868.0.4GHSA-6qmx-42h2-j8h6
NuGetmicrosoft.windowsdesktop.app.runtime.win-x866.0.29GHSA-6qmx-42h2-j8h6

Affected products (as reported)

VendorProductVersions
Microsoft Microsoft Visual Studio 2022 version 17.9 17.0 – before 17.9.6
Microsoft Microsoft Visual Studio 2022 version 17.4 17.4.0 – before 17.4.18
Microsoft Microsoft Visual Studio 2022 version 17.6 17.6.0 – before 17.6.14
Microsoft Microsoft Visual Studio 2022 version 17.8 17.8.0 – before 17.8.9
Microsoft PowerShell 7.3 7.3.0 – before 7.3.12
Microsoft PowerShell 7.4 7.4.0 – before 7.4.2
Microsoft PowerShell 7.2 7.2.0 – before 7.2.19
Microsoft .NET 6.0 6.0.0 – before 6.0.29
Microsoft .NET 7.0 7.0.0 – before 7.0.18
Microsoft .NET 8.0 8.0 – before 8.0.4
Microsoft Microsoft .NET Framework 4.8 4.8.0 – before 4.8.4718.0
Microsoft Microsoft .NET Framework 3.5 AND 4.8 4.8.0 – before 4.8.4718.0
Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 4.7.0 – before 4.7.4092.0
Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.0 – before 4.7.4092.0
Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1 – before 4.8.9236.0
Microsoft Microsoft .NET Framework 4.6.2 4.7.0 – before 4.7.4092.0

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

References