CVE-2022-41064: .NET Framework Information Disclosure Vulnerability

Severity: medium (CVSS 5.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-09 · updated 2026-08-10

Description

.NET Framework Information Disclosure Vulnerability

Affected products

Microsoft .NET Framework: 4.8, 4.8.1, 4.6.2, 4.7, 4.7.1, 4.7.2
Microsoft Nuget: before 1.1.4; from 2.0.0 before 2.1.2; from 3.0.0 before 4.8.5 — fixed in 1.1.4, 2.1.2, 4.8.5
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2: from 3.0.0.0 before 10.0.14393.5501 — fixed in 10.0.14393.5501
Microsoft .NET Framework 4.6.2: from 4.7.0 before 4.7.04005.02 — fixed in 4.7.04005.02
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2: from 4.7.0 before 4.7.04005.02 — fixed in 4.7.04005.02
Microsoft .NET Framework 4.6/4.6.2: from 10.0.0.0 before 10.0.10240.19567 — fixed in 10.0.10240.19567
Microsoft .NET Framework 4.7.2: from 10.0.0.0 before 10.0.04005.02 — fixed in 10.0.04005.02
Microsoft .NET Framework 4.8: from 4.8.0 before 4.8.04584.08 — fixed in 4.8.04584.08
Microsoft .NET Framework 4.8.1: from 4.8.0.0 before 4.8.09110.07 — fixed in 4.8.09110.07
Microsoft Nuget 2.1.2: from 1.0.0 before 2.1.2 — fixed in 2.1.2
Microsoft Nuget 4.8.5: from 1.0.0 before 4.8.4 — fixed in 4.8.4

How to fix

Upgrade to a fixed version: Microsoft Nuget 1.1.4, 2.1.2, 4.8.5; Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 10.0.14393.5501; Microsoft .NET Framework 4.6.2 4.7.04005.02; Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.04005.02; Microsoft .NET Framework 4.6/4.6.2 10.0.10240.19567; Microsoft .NET Framework 4.7.2 10.0.04005.02; Microsoft .NET Framework 4.8 4.8.04584.08; Microsoft .NET Framework 4.8.1 4.8.09110.07; Microsoft Nuget 2.1.2 2.1.2; Microsoft Nuget 4.8.5 4.8.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-41064 or the next vulnerability affects your stack