Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
23 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigation, add TrueType font protection and XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/451 CVSS Details - Version: 3.1 - Severity: High - Score: 8.8 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness: CWE-502 (Deserialization of Untrusted Data) Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Crafted WPF pixel-shader bytecode can desynchronize the two parsing passes in CPSTrans::Initialize, causing heap out-of-bounds writes or reads. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/450 CVSS Details - Version: 3.1 - Severity: High - Score: 8.8 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness: CWE-787 (Out-of-bounds Write) Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | ---------------…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. WPF XPS synthetic hyperlinks exposed through UI Automation can bypass restrictive navigation checks and reach attacker-controlled content, enabling remote code execution after user interaction. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/471 CVSS Details - Version: 3.1 - Severity: High - Score: 8.8 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness: CWE-502 (Deserialization of Untrusted Data) Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version |…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Crafted WPF pixel-shader bytecode can desynchronize the two parsing passes in CPSTrans::Initialize, causing heap out-of-bounds writes or reads. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/475 CVSS Details - Version: 3.1 - Severity: High - Score: 8.8 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness: CWE-787 (Out-of-bounds Write) Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | ---------------…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Attacker-controlled XPS glyph coordinates can overflow destination pointer arithmetic in CD3DGlyphBank::RectFillAlpha, causing an out-of-bounds write and process termination. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/469 CVSS Details - Version: 3.1 - Severity: High - Score: 8.8 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness: CWE-190 (Integer Overflow or Wraparound) Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigation, add TrueType font protection and XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/467 CVSS Details - Version: 3.1 - Severity: High - Score: 8.8 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness: CWE-502 (Deserialization of Untrusted Data) Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. WPF XPS hyperlink navigation can bypass URI restrictions and reach an attacker-controlled ObjectDataProvider, enabling remote code execution after user interaction. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/456 CVSS Details - Version: 3.1 - Severity: High - Score: 8.8 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness: CWE-358 (Improperly Implemented Security Check for Standard) Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigation, add TrueType font protection and XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/480 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness: CWE-125 (Out-of-bounds Read) Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigation, add TrueType font protection and XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/482 CVSS Details - Version: 3.1 - Severity: Moderate - Score: 5.3 - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness: CWE-346 (Origin Validation Error) Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and XPS security fixes block unsafe URI fetching and navigation, propagate untrusted-input state through hyperlink navigation, add TrueType font protection and XAML nesting-depth limits, and avoid caching positive DNS zone-policy decisions. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/477 CVSS Details - Version: 3.1 - Severity: Moderate - Score: 6.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness: CWE-183 (Permissive List of Allowed Inputs) Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Crafted WPF pixel-shader bytecode can desynchronize the two parsing passes in CPSTrans::Initialize, causing heap out-of-bounds writes or reads. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/483 CVSS Details - Version: 3.1 - Severity: High - Score: 8.8 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness: CWE-787 (Out-of-bounds Write) Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | ---------------…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A remote code execution vulnerability exists in Windows Presentation Foundation (WPF) in .NET 8, .NET 9, and .NET 10 when parsing specially crafted XAML input. An attacker who successfully exploits this vulnerability could execute arbitrary code in the context of the current user. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/TBD CVSS Details - Version: 3.1 - Severity: High - Score: 7.8 - Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness: CWE-693 (Protection Mechanism Failure) Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A specially crafted document parsed in .NET can trigger the inclusion of functionality from an untrusted control sphere, allowing an unauthorized attacker to disclose information over a network. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/433 CVSS Details - Version: 3.1 - Severity: Medium - Score: 6.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere; CWE-693: Protection Mechanism Failure; CWE-918: Server-Side Request Forgery (SSRF) Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects…
Recommended action: Upgrade to 10.0.11, 9.0.19 or 8.0.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/431 CVSS Details - Version: 3.1 - Severity: High - Score: 7.8 - Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-787: Out-of-bounds Write; CWE-122: Heap-based Buffer Overflow Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET 10"</a.NET 10 Package name | Affected version | Patched version ------------ | ---------------- |…
Recommended action: Upgrade to 10.0.11, 9.0.19 or 8.0.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An integer overflow or wraparound in .NET allows an unauthorized attacker to execute code locally. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/434 CVSS Details - Version: 3.1 - Severity: High - Score: 7.0 - Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-190: Integer Overflow or Wraparound Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET 10"</a.NET 10 Package name | Affected version | Patched version ------------ | ---------------- |…
Recommended action: Upgrade to 10.0.11, 9.0.19 or 8.0.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/432 CVSS Details - Version: 3.1 - Severity: High - Score: 7.8 - Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-787: Out-of-bounds Write Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET 10"</a.NET 10 Package name | Affected version | Patched version ------------ | ---------------- | -------------------------…
Recommended action: Upgrade to 10.0.11, 9.0.19 or 8.0.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/430 CVSS Details - Version: 3.1 - Severity: High - Score: 7.8 - Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-190: Integer Overflow or Wraparound; CWE-122: Heap-based Buffer Overflow Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET 10"</a.NET 10 Package name | Affected version | Patched version…
Recommended action: Upgrade to 10.0.11, 9.0.19 or 8.0.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An elevation of privilege vulnerability exists in Windows Presentation Foundation (WPF) in .NET 8, .NET 9, and .NET 10 when parsing specially crafted XAML input. An attacker who successfully exploits this vulnerability could elevate privileges on the affected system. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/421 CVSS Details - Version: 3.1 - Severity: High - Score: 7.8 - Vector: `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` - Weakness: CWE-94 (Improper Control of Generation of Code ('Code Injection')) Affected Platforms - Platforms: Windows - Architectures: All Affected Packages The vulnerability affects any…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/398 CVSS Details - Version: 3.1 - Severity: High - Score: 7.3 - Vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C - Weakness: CWE-122: Heap-based Buffer Overflow, CWE-20: Improper Input Validation Affected Platforms - Platforms: Windows - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET 10"</a.NET 10 Package name | Affected version | Patched version ------------ |…
Recommended action: Upgrade to 10.0.8, 9.0.16 or 8.0.27 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2024-21409 | .NET Elevation of Privilege Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 7.0 ,and .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A use-after-free vulnerability exists in WPF which may result in Elevation of Privilege when viewing untrusted documents. This is a Windows only vulnerability. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/303 <a name="mitigation-factors"</aMitigation factors This vulnerability affects only WPF-based applications. <a name="affected-software"</aAffected software Any .NET 6.0 application running on .NET 6.0.28 or earlier. Any .NET 7.0 application running on .NET 7.0.17 or earlier. Any .NET 8.0 application running on .NET 8.0.3 or earlier. <a…
Recommended action: Upgrade to 8.0.4, 7.0.18 or 6.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2023-33127: .NET Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET applications where the diagnostic server can be exploited to achieve cross-session/cross-user elevation of privilege (EoP) and code execution. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/263 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 7.0 application running on .NET 7.0.8 or earlier. Any .NET 6.0 application running on .NET 6.0.19 or earlier. If your application uses the following package…
Recommended action: Upgrade to 7.0.9 or 6.0.20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2023-24895: .NET Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in how WPF applications load and render XPS documents which may result in remote code execution. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/261 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 7.0 application running on .NET 7.0.5 or earlier. Any .NET 6.0 application running on .NET 6.0.16 or earlier. If your application uses the following package versions, ensure you update to the latest version of .NET.…
Recommended action: Upgrade to 7.0.7 or 6.0.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2022-41089: .NET Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1, .NET 6.0., and .NET 7.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A remote code execution vulnerability exists in .NET Core 3.1, .NET 6.0, and .NET 7.0, where a malicious actor could cause a user to run arbitrary code as a result of parsing maliciously crafted xps files. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/242 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 7.0 WinForms or WPF application running on .NET 7.0.0 or earlier. Any .NET 6.0 WinForms or WPF application…
Recommended action: Upgrade to 7.0.1 or 6.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.