Skip to content
OpenAdvisories
Critical MSRC-CVE-2023-36792 1 CVE

Visual Studio Remote Code Execution Vulnerability

Published Sep 12, 2023 · Updated Dec 12, 2023 · Revision 9

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
Exploitation of this vulnerability requires that an attacker convinces a user to open a maliciously crafted package file in Visual Studio.

Security updates
15.9.57 — https://docs.microsoft.com/en-us/visualstudio/releasenotes/vs2017-relnotes
17.2.21 — https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes
16.11.30 — https://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.11
17.4.13 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
6.0.24 — https://support.microsoft.com/help/5032874
7.0.13 — https://support.microsoft.com/help/5032875
7.2.12 — https://github.com/PowerShell/Announcements/issues/50
4.8.04667.02 — https://support.microsoft.com/help/5030183
4.8.04667.02 — https://support.microsoft.com/help/5030184
4.8.04667.03 — https://support.microsoft.com/help/5030178
4.8.04667.02 — https://support.microsoft.com/help/5030182
4.8.04667.02 — https://support.microsoft.com/help/5029924
4.8.04667.03 — https://support.microsoft.com/help/5030186
4.8.04667.02 — https://support.microsoft.com/help/5030179
4.8.04667.02 — https://support.microsoft.com/help/5030181
4.8.04667.02 — https://support.microsoft.com/help/5030180
10.0.14393.6252 — https://support.microsoft.com/help/5030213
4.8.09186.0 — https://support.microsoft.com/help/5031217
4.7.04063.01 — https://support.microsoft.com/help/5030185
10.0.10240.20162 — https://support.microsoft.com/help/5030220

Vulnerabilities 1

Revision history

  1. #9

    Microsoft is rereleasing KB5029365 to address the following known issue: Customers who are using Microsoft Visual Studio 2013 Update 5 might receive a "C2471" error after attempting to compile a build that has precompiled headers (PCH) that use the /Gm and /ZI (Edit and Continue) switches. Microsoft recommends that customers install the update and remove any workarounds that were applied. For more information see [KB5029365](https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-the-remote-code-execution-vulnerability-in-microsoft-visual-studio-2013-update-5-october-10-2023-kb5029365-eb9e61cd-c7d3-4235-b268-b099d5f748dc).

  2. #8

    Microsoft is rereleasing KB5029366 to address the following known issue: Customers who are using Microsoft Visual Studio 2015 Update 3 might receive a "C2471" error after attempting to compile a build that has precompiled headers (PCH) that use the /Gm and /ZI (Edit and Continue) switches. Microsoft recommends that customers install the update and remove any workarounds that were applied. For more information see [KB5029366](https://support.microsoft.com/en-gb/topic/description-of-the-security-update-for-the-remote-code-execution-vulnerability-in-microsoft-visual-studio-2015-update-3-october-10-2023-kb5029366-7b4ac004-f805-4799-a06b-cebc20348a79).

  3. #7

    Corrected Download and Article links in the Security Updates table. This is an informational change only.

  4. #5

    To comprehensively address CVE-2023-36792, Microsoft has released security updates on October 24, 2023 for all affected versions of .NET and Microsoft Visual Studio. In addition, the following corrections have been made in the Security Updates table: 1) Added Visual Studio 2022 version 17.6 as it is also affected by this vulnerability. 2) Corrected the Impact to Critical for Visual Studio 2022 version 17.7.

  5. #6

    In the Security Updates table, added .NET Framework 3.5 and 4.6.2 installed on Windows 10 for 32-bit systems and Windows 10 for x64-based systems; added .NET Framework 3.5 and 4.6.2/4.7./4.7.1/4.7.2 installed on all supported editions of Windows 10 version 1607 and Windows Server 2016 as these versions of .NET Framework are affected by this vulnerability. Microsoft recommends that customers install the September 2023 updates to be fully protected from this vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.

  6. #4

    In the Security Updates table, added Microsoft Visual Studio 2013 Update 5 and Visual Studio 2015 Update 3 as these versions of Visual Studio are also affected by the vulnerability. Microsoft recommends that customers running any of these products install the updates to be fully protected from the vulnerability.

  7. #3

    In the Security Update table, corrected Article links for Microsoft .NET Framework 3.5 AND 4.8.1 installed on Windows 11 Version 22H2 for x64-based Systems and Windows 11 Version 22H2 for ARM64-based Systems. This is an informational change only.

  8. #2

    Revised the Security Updates table to include PowerShell 7.2 because this version of PowerShell 7 is affected by this vulnerability. See [https://github.com/PowerShell/Announcements/issues/50](https://github.com/PowerShell/Announcements/issues/50) for more information.

  9. #1

    Information published.

References