Skip to content
OpenAdvisories
Unscored Public exploit CVE-2020-1066 EUVD-2020-11957GHSA-jp98-j3r8-w99v

.NET Framework Elevation of Privilege Vulnerability

Published May 21, 2020 · Updated Aug 19, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Microsoft .NET Framework 3.0 Service Pack 2 Product: Microsoft .NET Framework 3.5.1

Description

An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level.
To exploit the vulnerability, an attacker would first have to access the local machine, and then run a malicious program.
The update addresses the vulnerability by correcting how .NET Framework activates COM objects.

Affected products

VendorProductAffectedFixed
Microsoft Microsoft .NET Framework 3.0 Service Pack 2 3.0.0 – < publication publication
Microsoft Microsoft .NET Framework 3.5.1 3.5.0 – < publication publication

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References