https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:12:26.594788+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-03190 bdu:2024-03190 2026-10-02T14:12:26.602458+00:00 bdu:2024-03190 https://cve.radiocsirt.org/vuln/bell-cve-2024-21409 BELL-CVE-2024-21409 2026-10-02T14:12:26.602490+00:00

Affected: Alpaquita:stream: dotnet6-build, Alpaquita:stream: dotnet6-runtime

 https://cve.radiocsirt.org/vuln/bit-dotnet-2024-21409 BIT-dotnet-2024-21409 — .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability 2026-10-02T14:12:26.602517+00:00

Affected: Bitnami: dotnet

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0290 certfr-2024-avi-0290 — Une vulnérabilité a été découverte dans <span class="textit">Microsoft .Net</span>. Elle permet à un attaquant de provo… 2026-10-02T14:12:26.602538+00:00 certfr-2024-avi-0290 https://cve.radiocsirt.org/vuln/cleanstart-2025-bh85010 CLEANSTART-2025-BH85010 — .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability 2026-10-02T14:12:26.602553+00:00

Affected: CleanStart: dotnet6-build, CleanStart: dotnet6-runtime, CleanStart: dotnet8-runtime

CVE-2024-21409 affects multiple packages. . See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-236976 EUVD-2026-236976 2026-10-02T14:12:26.602574+00:00 EUVD-2026-236976 https://cve.radiocsirt.org/vuln/fkie_cve-2024-21409 fkie_cve-2024-21409 2026-10-02T14:12:26.602585+00:00

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

 https://cve.radiocsirt.org/vuln/ghsa-6qmx-42h2-j8h6 GHSA-6qmx-42h2-j8h6 — .NET Elevation of Privilege Vulnerability 2026-10-02T14:12:26.602602+00:00

Affected: NuGet: Microsoft.WindowsDesktop.App.Runtime.win-arm64, NuGet: Microsoft.WindowsDesktop.App.Runtime.win-x64, NuGet: Microsoft.WindowsDesktop.App.Runtime.win-x86

# Microsoft Security Advisory CVE-2024-21409 | .NET Elevation of Privilege Vulnerability

## <a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 7.0 ,and .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A use-after-free vulnerability exists in WPF which may result in Elevation of Privilege when viewing untrusted documents. This is a Windows only vulnerability.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/303

## <a name="mitigation-factors"></a>Mitigation factors

This vulnerability affects only WPF-based applications.

## <a name="affected-software"></a>Affected software

* Any .NET 6.0 application running on .NET 6.0.28 or earlier. * Any .NET 7.0 application running on .NET 7.0.17 or earlier. * Any .NET 8.0 application running on .NET 8.0.3 or earlier.

## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below

### <a name=".NET 7"></a>.NET 6.0

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | < = 6.0.28 | 6.0.…

 https://cve.radiocsirt.org/vuln/gsd-2024-21409 gsd-2024-21409 2026-10-02T14:12:26.602670+00:00 gsd-2024-21409 https://cve.radiocsirt.org/vuln/msrc_cve-2024-21409 msrc_CVE-2024-21409 — .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability 2026-10-02T14:12:26.602682+00:00 msrc_CVE-2024-21409 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0839 WID-SEC-W-2024-0839 — Microsoft Developer Tools: Mehrere Schwachstellen ermöglichen Codeausführung 2026-10-02T14:12:26.602697+00:00

Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft .NET Framework, Microsoft Visual Studio 2019 und Microsoft Visual Studio 2022 ausnutzen, um beliebigen Programmcode auszuführen.