What’s Vulnerable › Vulnerabilities

CVE-2023-35390: .NET and Visual Studio Remote Code Execution Vulnerability

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-08-08 · updated 2026-08-10
• Weakness: CWE-77

Description

.NET and Visual Studio Remote Code Execution Vulnerability

Affected products

• Microsoft .NET: from 6.0.0 before 6.0.21; from 7.0.0 before 7.0.10 — fixed in 6.0.21, 7.0.10
• Microsoft Visual Studio 2022 version 17.14: from 17.2.0 before 17.2.18; from 17.4.0 before 17.4.10; from 17.6.0 before 17.6.6 — fixed in 17.2.18, 17.4.10, 17.6.6
• Microsoft .NET 6.0: from 6.0.0 before 6.0.21 — fixed in 6.0.21
• Microsoft .NET 7.0: from 7.0.0 before 7.0.10 — fixed in 7.0.10
• Microsoft Visual Studio 2022 version 17.2: from 17.2.0 before 17.2.18 — fixed in 17.2.18
• Microsoft Visual Studio 2022 version 17.4: from 17.4.0 before 17.4.10 — fixed in 17.4.10
• Microsoft Visual Studio 2022 version 17.6: from 17.6.0 before 17.6.6 — fixed in 17.6.6

How to fix

Upgrade to a fixed version: Microsoft .NET 6.0.21, 7.0.10; Microsoft Visual Studio 2022 version 17.14 17.2.18, 17.4.10, 17.6.6; Microsoft .NET 6.0 6.0.21; Microsoft .NET 7.0 7.0.10; Microsoft Visual Studio 2022 version 17.2 17.2.18; Microsoft Visual Studio 2022 version 17.4 17.4.10; Microsoft Visual Studio 2022 version 17.6 17.6.6. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35390
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CL2L4WE5QRT7WEXANYXSKSU43APC5N2V/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWVZFKTLNMNKPZ755EMRYIA6GHFOWGKY/
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35390

Get alerted when CVE-2023-35390 or the next vulnerability affects your stack