Skip to content
OpenAdvisories
Critical MSRC-CVE-2024-43498 1 CVE

.NET and Visual Studio Remote Code Execution Vulnerability

Published Nov 12, 2024 · Updated Jan 29, 2025 · Revision 2

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
A remote unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to a vulnerable .NET webapp or by loading a specially crafted file into a vulnerable desktop app.

Security updates
7.5.0 — https://github.com/PowerShell/Announcements/issues/74
17.8.16 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
9.0.0 — https://github.com/dotnet/announcements/issues/334

Vulnerabilities 1

Revision history

  1. #2

    Revised the Security Updates table to include PowerShell 7.5 installed on Windows, PowerShell 7.5 installed on Linux, and PowerShell 7.5 installed on MacOC because these versions of PowerShell 7 are affected by this vulnerability. See [https://github.com/PowerShell/Announcements/issues/74](https://github.com/PowerShell/Announcements/issues/74) for more information.

  2. #1

    Information published.

References