CVE-2024-30045 — .NET and Visual Studio Remote Code Execution Vulnerability

Description

.NET and Visual Studio Remote Code Execution Vulnerability

Affected products

Vendor	Product	Affected	Fixed
Microsoft	.NET 8.0	8.0 – < 8.0.5	8.0.5
Microsoft	.NET 7.0	7.0.0 – < 7.0.19	7.0.19
Microsoft	Microsoft Visual Studio 2022 version 17.9	17.0 – < 17.9.7	17.9.7
Microsoft	Microsoft Visual Studio 2022 version 17.4	17.4.0 – < 17.4.19	17.4.19
Microsoft	Microsoft Visual Studio 2022 version 17.6	17.6.0 – < 17.6.15	17.6.15
Microsoft	Microsoft Visual Studio 2022 version 17.8	17.8.0 – < 17.8.10	17.8.10
Microsoft	PowerShell 7.4	7.4.0 – < 7.4.3	7.4.3

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 24.04 LTS	dotnet8	8.0.105-8.0.5-0ubuntu1~24.04.1	USN-6773-1
Ubuntu 22.04 LTS	dotnet7	7.0.119-0ubuntu1~22.04.1	USN-6773-1
Ubuntu 22.04 LTS	dotnet8	8.0.105-8.0.5-0ubuntu1~22.04.1	USN-6773-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	dotnet-host +8	8.0.5-1.el9_4	RHSA-2024:2842
RHEL 9	dotnet-hostfxr-7.0 +5	7.0.19-1.el9_4	RHSA-2024:2843
RHEL 9	dotnet7.0 +3	7.0.119-1.el9_4	RHSA-2024:2843
RHEL 9	dotnet8.0 +5	8.0.105-1.el9_4	RHSA-2024:2842
RHEL 8	dotnet +6	8.0.105-1.el8_10	RHSA-2024:3345
RHEL 8	dotnet-host +8	8.0.5-1.el8_10	RHSA-2024:3345
RHEL 8	dotnet-hostfxr-7.0 +5	7.0.19-1.el8_10	RHSA-2024:3340
RHEL 8	dotnet7.0 +3	7.0.119-1.el8_10	RHSA-2024:3340

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	dotnet-host +8	8.0.5-1.el9_4	ALSA-2024:2842
AlmaLinux 9	dotnet-hostfxr-7.0 +5	7.0.19-1.el9_4	ALSA-2024:2843
AlmaLinux 9	dotnet-sdk-7.0 +2	7.0.119-1.el9_4	ALSA-2024:2843
AlmaLinux 9	dotnet-sdk-8.0 +4	8.0.105-1.el9_4	ALSA-2024:2842
AlmaLinux 8	dotnet +5	8.0.105-1.el8_10	ALSA-2024:3345
AlmaLinux 8	dotnet-host +8	8.0.5-1.el8_10	ALSA-2024:3345
AlmaLinux 8	dotnet-hostfxr-7.0 +5	7.0.19-1.el8_10	ALSA-2024:3340
AlmaLinux 8	dotnet-sdk-7.0 +2	7.0.119-1.el8_10	ALSA-2024:3340

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 9	dotnet7.0	7.0.119-1.el9_4	RLSA-2024:2843
Rocky Linux 9	dotnet8.0	8.0.105-1.el9_4	RLSA-2024:2842
Rocky Linux 8	dotnet7.0	7.0.119-1.el8_10	RLSA-2024:3340
Rocky Linux 8	dotnet8.0	8.0.105-1.el8_10	RLSA-2024:3345

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	dotnet8-runtime	8.0.5-r0	—
Alpine v3.23	dotnet8-runtime	8.0.5-r0	—
Alpine v3.22	dotnet8-runtime	8.0.5-r0	—
Alpine v3.21	dotnet8-runtime	8.0.5-r0	—
Alpine v3.20	dotnet8-runtime	8.0.5-r0	—

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	dotnet7-runtime	7.0.19-r0	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	dotnet-host +8	8.0.5-1.0.1.el9_4	ELSA-2024-2842
Oracle Linux 9	dotnet-hostfxr-7.0 +5	7.0.19-1.0.1.el9_4	ELSA-2024-2843
Oracle Linux 9	dotnet-sdk-7.0 +2	7.0.119-1.0.1.el9_4	ELSA-2024-2843
Oracle Linux 9	dotnet-sdk-8.0 +4	8.0.105-1.0.1.el9_4	ELSA-2024-2842
Oracle Linux 8	dotnet +5	8.0.105-1.0.1.el8_10	ELSA-2024-3345
Oracle Linux 8	dotnet-host +8	8.0.5-1.0.1.el8_10	ELSA-2024-3345
Oracle Linux 8	dotnet-hostfxr-7.0 +5	7.0.19-1.0.1.el8_10	ELSA-2024-3340
Oracle Linux 8	dotnet-sdk-7.0 +2	7.0.119-1.0.1.el8_10	ELSA-2024-3340

Affected packages

Ecosystem	Package	Affected	Fixed	Record
NuGet	Microsoft.NETCore.App.Runtime.linux-arm	>= 7.0.0, < 7.0.19	7.0.19	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.linux-arm	>= 8.0.0, < 8.0.5	8.0.5	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.linux-arm64	>= 7.0.0, < 7.0.19	7.0.19	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.linux-arm64	>= 8.0.0, < 8.0.5	8.0.5	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-arm	>= 7.0.0, < 7.0.19	7.0.19	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-arm	>= 8.0.0, < 8.0.5	8.0.5	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-arm64	>= 8.0.0, < 8.0.5	8.0.5	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-arm64	>= 7.0.0, < 7.0.19	7.0.19	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-x64	>= 7.0.0, < 7.0.19	7.0.19	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.linux-musl-x64	>= 8.0.0, < 8.0.5	8.0.5	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.linux-x64	>= 7.0.0, < 7.0.19	7.0.19	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.linux-x64	>= 8.0.0, < 8.0.5	8.0.5	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.osx-arm64	>= 7.0.0, < 7.0.19	7.0.19	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.osx-arm64	>= 8.0.0, < 8.0.5	8.0.5	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.osx-x64	>= 7.0.0, < 7.0.19	7.0.19	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.osx-x64	>= 8.0.0, < 8.0.5	8.0.5	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.win-arm	>= 7.0.0, < 7.0.19	7.0.19	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.win-arm	>= 8.0.0, < 8.0.5	8.0.5	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.win-arm64	>= 7.0.0, < 7.0.19	7.0.19	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.win-arm64	>= 8.0.0, < 8.0.5	8.0.5	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.win-x64	>= 7.0.0, < 7.0.19	7.0.19	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.win-x64	>= 8.0.0, < 8.0.5	8.0.5	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.win-x86	>= 7.0.0, < 7.0.19	7.0.19	GHSA-7fcr-8qw6-92fr
NuGet	Microsoft.NETCore.App.Runtime.win-x86	>= 8.0.0, < 8.0.5	8.0.5	GHSA-7fcr-8qw6-92fr

Advisories 22

ALSA-2024:3340 Important: .NET 7.0 security update AlmaLinux Security Advisories · Nov 6, 2026
ALSA-2024:2843 Important: .NET 7.0 security update AlmaLinux Security Advisories · Nov 5, 2026
ALSA-2024:2842 Important: .NET 8.0 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2024:3345 Important: .NET 8.0 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2024:3340 Red Hat Security Advisory: .NET 7.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
RHSA-2024:2843 Red Hat Security Advisory: .NET 7.0 security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
RHSA-2024:2842 Red Hat Security Advisory: .NET 8.0 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2024:3345 Red Hat Security Advisory: .NET 8.0 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
USN-6773-1 dotnet7, dotnet8 vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
RLSA-2024:3345 Important: .NET 8.0 security update Rocky Linux Security Advisories · Feb 5, 2026
RLSA-2024:2842 Important: .NET 8.0 security update Rocky Linux Security Advisories · Feb 4, 2026
RLSA-2024:3340 Important: .NET 7.0 security update Rocky Linux Security Advisories · Feb 4, 2026
RLSA-2024:2843 Important: .NET 7.0 security update Rocky Linux Security Advisories · Oct 9, 2025
NCSC-2024-0332 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Aug 13, 2024
SSA-417547 SSA-417547: Multiple Vulnerabilities in INTRALOG WMS Before V4 Siemens ProductCERT · Aug 13, 2024
ICSA-24-228-02 Siemens INTRALOG WMS CISA ICS & IT advisories · Aug 13, 2024
MSRC-CVE-2024-30045 .NET and Visual Studio Remote Code Execution Vulnerability Microsoft Security Response Center · Jun 19, 2024
WID-SEC-2024-1115 Microsoft Developer Tools: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 30, 2024
ELSA-2024-3345 Important: .NET 8.0 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 29, 2024
ELSA-2024-3340 Important: .NET 7.0 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 29, 2024
ELSA-2024-2843 Important: .NET 7.0 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 14, 2024
ELSA-2024-2842 Important: .NET 8.0 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 14, 2024

References

.NET and Visual Studio Remote Code Execution Vulnerability vendor-advisory

CNA	v3.1	6.3
EUVD	v3.1	6.3
OSV:GHSA	v3.1	6.3