CVE-2023-38178: .NET Core and Visual Studio Denial of Service Vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-08 · updated 2026-08-10
Weakness: CWE-400

Description

.NET Core and Visual Studio Denial of Service Vulnerability

Affected products

Microsoft .NET: 6.0.0
Microsoft Visual Studio 2022 version 17.14: from 17.2.0 before 17.2.18; from 17.4.0 before 17.4.10 — fixed in 17.2.18, 17.4.10
Microsoft .NET 6.0: from 6.0.0 before 6.0.21 — fixed in 6.0.21
Microsoft Visual Studio 2022 version 17.2: from 17.2.0 before 17.2.18 — fixed in 17.2.18
Microsoft Visual Studio 2022 version 17.4: from 17.4.0 before 17.4.10 — fixed in 17.4.10

How to fix

Upgrade to a fixed version: Microsoft Visual Studio 2022 version 17.14 17.2.18, 17.4.10; Microsoft .NET 6.0 6.0.21; Microsoft Visual Studio 2022 version 17.2 17.2.18; Microsoft Visual Studio 2022 version 17.4 17.4.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-38178 or the next vulnerability affects your stack