What’s Vulnerable › Vulnerabilities

CVE-2021-31204: .NET and Visual Studio Elevation of Privilege Vulnerability

• Severity: medium (CVSS 4.6 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-11 · updated 2026-10-07
• Weakness: CWE-269

Description

.NET and Visual Studio Elevation of Privilege Vulnerability

Affected products

• Fedoraproject Fedora: 32, 33, 34
• Microsoft .NET: from 5.0 through 5.0.5
• Microsoft Corporation .NET Core: from 3.1 through 3.1.14
• Microsoft Visual Studio 2019: from 16.0 before 16.4.22; from 16.5.0 before 16.7.15; from 16.8.0 before 16.9.5; 8.9 — fixed in 16.4.22, 16.7.15, 16.9.5
• Microsoft .NET 5.0: from 5.0.0 before 5.0.6-servicing.21220.11 — fixed in 5.0.6-servicing.21220.11
• Microsoft .NET Core 3.1: from 3.1 before 3.1.15-servicing.21214.3 — fixed in 3.1.15-servicing.21214.3
• Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3): from 16.0 before publication — fixed in publication
• Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6): from 16.0.0 before publication — fixed in publication
• Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8): from 15.0.0 before publication — fixed in publication
• Microsoft Visual Studio 2019 for Mac version 8.9: from 8.0 before publication — fixed in publication

How to fix

Upgrade to a fixed version: Microsoft Visual Studio 2019 16.4.22, 16.7.15, 16.9.5; Microsoft .NET 5.0 5.0.6-servicing.21220.11; Microsoft .NET Core 3.1 3.1.15-servicing.21214.3; Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) publication; Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) publication; Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) publication; Microsoft Visual Studio 2019 for Mac version 8.9 publication. Check the vendor advisory for mitigations.

References

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F3VM3RMPE7PNNLLI3BPCSAXITQZCFCA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6M7KL3KTHJVQNRA3CWFUTESQJARQEHSZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FVMWZPF4FR6JPFSNAIDIUDULHZJBVCW6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFXJPQUYUITJMV75YN3XIGE3KKN5GOCU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UV4ITB3SUDGR23G7XALUVKFJMZERFUKF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWF25Z3CZ6LYCOHZ7FPSFAQ426JUBUZ4/
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31204
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F3VM3RMPE7PNNLLI3BPCSAXITQZCFCA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6M7KL3KTHJVQNRA3CWFUTESQJARQEHSZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FVMWZPF4FR6JPFSNAIDIUDULHZJBVCW6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFXJPQUYUITJMV75YN3XIGE3KKN5GOCU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UV4ITB3SUDGR23G7XALUVKFJMZERFUKF/

Get alerted when CVE-2021-31204 or the next vulnerability affects your stack