CVE-2024-0057: NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-09 · updated 2026-06-17
Weakness: CWE-20

Description

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

Affected products

Microsoft .NET: from 6.0.0 before 6.0.26; from 7.0.0 before 7.0.15; 8.0.0 — fixed in 6.0.26, 7.0.15
Microsoft .NET Framework: from 4.8 before 4.8.04690.02; from 4.8 before 4.8.04690.01; 4.6.2, 4.7, 4.7.1, 4.7.2, 3.5, 4.8.1 (+2) — fixed in 4.8.04690.01, 4.8.04690.02
Microsoft Powershell: from 7.2 before 7.2.18; from 7.3 before 7.3.11; 7.4 — fixed in 7.2.18, 7.3.11
Microsoft Visual Studio 2022 version 17.14: from 17.2 before 17.2.23; from 17.4 before 17.4.15; from 17.6 before 17.6.11; from 17.8 before 17.8.4 — fixed in 17.2.23, 17.4.15, 17.6.11, 17.8.4
Microsoft .NET 6.0: from 6.0.0 before 6.0.26 — fixed in 6.0.26
Microsoft .NET 7.0: from 7.0.0 before 7.0.15 — fixed in 7.0.15
Microsoft .NET 8.0: from 8.0 before 8.0.1 — fixed in 8.0.1
Microsoft .NET Framework 2.0 Service Pack 2: from 2.0.0 before 3.0.50727.8976 — fixed in 3.0.50727.8976
Microsoft .NET Framework 3.0 Service Pack 2: from 3.0.0 before 3.0.50727.8976 — fixed in 3.0.50727.8976
Microsoft .NET Framework 3.5 AND 4.7.2: from 4.7.0 before 4.7.04081.03 — fixed in 4.7.04081.03
Microsoft .NET Framework 3.5 AND 4.8: from 4.8.0 before 4.8.04690.02 — fixed in 4.8.04690.02
Microsoft .NET Framework 3.5 AND 4.8.1: from 4.8.1 before 4.8.09214.01 — fixed in 4.8.09214.01
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2: from 4.7.0 before 4.7.04081.02 — fixed in 4.7.04081.02
Microsoft .NET Framework 4.8: from 4.8.0 before 4.8.04690.02 — fixed in 4.8.04690.02
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10): from 16.11.0 before 16.11.34 — fixed in 16.11.34
Microsoft Visual Studio 2022 version 17.2: from 17.2.0 before 17.2.23 — fixed in 17.2.23
Microsoft Visual Studio 2022 version 17.4: from 17.4.0 before 17.4.15 — fixed in 17.4.15
Microsoft Visual Studio 2022 version 17.6: from 17.6.0 before 17.6.11 — fixed in 17.6.11
Microsoft Visual Studio 2022 version 17.8: from 17.8.0 before 17.8.4 — fixed in 17.8.4
Microsoft NuGet 17.4.0: from 17.4.0 before 17.4.3.0 — fixed in 17.4.3.0
Microsoft NUGET 17.6.0: from 17.6.0 before 17.6.2.0 — fixed in 17.6.2.0
Microsoft NuGet 17.8.0: from 17.8.0 before 17.8.1.0 — fixed in 17.8.1.0
Microsoft NuGet 5.11.0: from 5.11.0 before 5.11.6.0 — fixed in 5.11.6.0
Microsoft PowerShell 7.2: from 7.2.0 before 7.2.18 — fixed in 7.2.18
Microsoft PowerShell 7.3: from 7.3.0 before 7.3.11 — fixed in 7.3.11
Microsoft PowerShell 7.4: from 7.4.0 before 7.4.2 — fixed in 7.4.2

How to fix

Upgrade to a fixed version: Microsoft .NET 6.0.26, 7.0.15; Microsoft .NET Framework 4.8.04690.01, 4.8.04690.02; Microsoft Powershell 7.2.18, 7.3.11; Microsoft Visual Studio 2022 version 17.14 17.2.23, 17.4.15, 17.6.11, 17.8.4; Microsoft .NET 6.0 6.0.26; Microsoft .NET 7.0 7.0.15; Microsoft .NET 8.0 8.0.1; Microsoft .NET Framework 2.0 Service Pack 2 3.0.50727.8976; Microsoft .NET Framework 3.0 Service Pack 2 3.0.50727.8976; Microsoft .NET Framework 3.5 AND 4.7.2 4.7.04081.03; Microsoft .NET Framework 3.5 AND 4.8 4.8.04690.02; Microsoft .NET Framework 3.5 AND 4.8.1 4.8.09214.01. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-0057 or the next vulnerability affects your stack