Most recent entries from all

bdu:2024-03190

BELL-CVE-2024-21409

Affected: Alpaquita:stream: dotnet6-build, Alpaquita:stream: dotnet6-runtime

BIT-dotnet-2024-21409 — .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Affected: Bitnami: dotnet

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

certfr-2024-avi-0290 — Une vulnérabilité a été découverte dans Microsoft .Net. Elle permet à un attaquant de provo…

certfr-2024-avi-0290

CLEANSTART-2025-BH85010 — .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Affected: CleanStart: dotnet6-build, CleanStart: dotnet6-runtime, CleanStart: dotnet8-runtime

CVE-2024-21409 affects multiple packages. . See references for individual vulnerability details.

EUVD-2026-236976

fkie_cve-2024-21409

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

GHSA-6qmx-42h2-j8h6 — .NET Elevation of Privilege Vulnerability

Affected: NuGet: Microsoft.WindowsDesktop.App.Runtime.win-arm64, NuGet: Microsoft.WindowsDesktop.App.Runtime.win-x64, NuGet: Microsoft.WindowsDesktop.App.Runtime.win-x86

# Microsoft Security Advisory CVE-2024-21409 | .NET Elevation of Privilege Vulnerability

## <a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 7.0 ,and .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A use-after-free vulnerability exists in WPF which may result in Elevation of Privilege when viewing untrusted documents. This is a Windows only vulnerability.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/303

## <a name="mitigation-factors"></a>Mitigation factors

This vulnerability affects only WPF-based applications.

## <a name="affected-software"></a>Affected software

* Any .NET 6.0 application running on .NET 6.0.28 or earlier. * Any .NET 7.0 application running on .NET 7.0.17 or earlier. * Any .NET 8.0 application running on .NET 8.0.3 or earlier.

## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below

### <a name=".NET 7"></a>.NET 6.0

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64) | < = 6.0.28 | 6.0.…

gsd-2024-21409

msrc_CVE-2024-21409 — .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

msrc_CVE-2024-21409

WID-SEC-W-2024-0839 — Microsoft Developer Tools: Mehrere Schwachstellen ermöglichen Codeausführung

Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft .NET Framework, Microsoft Visual Studio 2019 und Microsoft Visual Studio 2022 ausnutzen, um beliebigen Programmcode auszuführen.