CVE-2023-24897

Summary

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Affected Software

VendorProductVersion RangeStatus
MicrosoftMicrosoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)15.9.0 < 15.9.55affected
MicrosoftMicrosoft Visual Studio 2022 version 17.217.2.0 < 17.2.16affected
MicrosoftMicrosoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)16.11.0 < 16.11.27affected
MicrosoftMicrosoft Visual Studio 2022 version 17.017.0.0 < 17.0.22affected
MicrosoftMicrosoft Visual Studio 2022 version 17.417.4.0 < 17.4.8affected
MicrosoftMicrosoft Visual Studio 2013 Update 512.0.0 < 12.0.40700.0affected
MicrosoftMicrosoft Visual Studio 2015 Update 314.0.0 < 14.0.27555.0affected
Microsoft.NET 7.07.0.0 < 7.0.7affected
Microsoft.NET 6.06.0.0 < 6.0.18affected
MicrosoftMicrosoft Visual Studio 2022 version 17.617.6.0 < 17.6.3affected
MicrosoftPowerShell 7.27.2.0 < 7.2.12affected
MicrosoftMicrosoft .NET Framework 3.5 AND 4.84.8.0 < 4.8.4644.0affected
MicrosoftMicrosoft .NET Framework 4.84.8.0 < 4.8.4644.0affected
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.24.7.0 < 4.7.4050.0affected
MicrosoftMicrosoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.23.0.0.0 < 10.0.14393.5989affected
MicrosoftMicrosoft .NET Framework 4.6.2/4.7/4.7.1/4.7.24.7.0 < 4.7.04043.0affected
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8.14.8.1 < 4.8.9166.0affected
MicrosoftMicrosoft .NET Framework 4.6.24.7.0 < 4.7.04043.0affected
MicrosoftMicrosoft .NET Framework 3.5 and 4.6.24.7.0 < 10.0.10240.19983affected

Weaknesses

  • CWE-122: CWE-122: Heap-based Buffer Overflow

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References