.net Framework (Microsoft) - vulnerabilities (CVEs)

224 CVEs, 18 in the last 30 days, 54 known versions, newest CVE from 2026-10-13. Vendor: Microsoft.

CVEs of .net Framework

CVE-2026-97801 - CVSS 7.5 (high), 2026-10-13: Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
CVE-2026-102869 - CVSS 8.8 (high), 2026-10-13: Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-58280 - CVSS 7.5 (high), 2026-10-13: Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-97788 - CVSS 7.5 (high), 2026-10-13: Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
CVE-2026-96959 - CVSS 7.5 (high), 2026-10-13: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96958 - CVSS 7.5 (high), 2026-10-13: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96960 - CVSS 7.5 (high), 2026-10-13: Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96233 - CVSS 7.5 (high), 2026-10-13: Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70007 - CVSS 8.8 (high), 2026-10-13: Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
CVE-2026-83520 - CVSS 8.8 (high), 2026-10-13: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-85363 - CVSS 8.8 (high), 2026-10-13: Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-70035 - CVSS 8.8 (high), 2026-10-13: Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
CVE-2026-84008 - CVSS 7.5 (high), 2026-10-13: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96222 - CVSS 7.4 (high), 2026-10-13: Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-96224 - CVSS 8.8 (high), 2026-10-13: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70174 - CVSS 8.8 (high), 2026-10-13: Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-69651 - CVSS 7.5 (high), 2026-10-13: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-108398 - CVSS 8.8 (high), 2026-10-13: Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
CVE-2026-69522 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2026-70354 - CVSS 7.8 (high), 2026-08-11: Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-65810 - CVSS 7.8 (high), 2026-08-11: Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.
CVE-2026-62886 - CVSS 7.8 (high), 2026-08-11: Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-62872 - CVSS 8.8 (high), 2026-08-11: Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.
CVE-2026-62897 - CVSS 7 (high), 2026-08-11: Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
CVE-2026-50659 - CVSS 6.5 (medium), 2026-07-14: Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
CVE-2026-50650 - CVSS 7.8 (high), 2026-07-14: Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.
CVE-2026-50649 - CVSS 7.8 (high), 2026-07-14: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-50648 - CVSS 7.5 (high), 2026-07-14: Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50646 - CVSS 7.8 (high), 2026-07-14: Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.
CVE-2026-50527 - CVSS 7.5 (high), 2026-07-14: Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50525 - CVSS 7.5 (high), 2026-07-14: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-47304 - CVSS 9.8 (critical), 2026-07-14: Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-47302 - CVSS 7.5 (high), 2026-07-14: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-50647 - CVSS 7.5 (high), 2026-07-14: Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a…
CVE-2026-50411 - CVSS 7.5 (high), 2026-07-14: Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
CVE-2026-50355 - CVSS 7.5 (high), 2026-07-14: Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
CVE-2026-50324 - CVSS 5.9 (medium), 2026-07-14: Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a…
CVE-2026-50368 - CVSS 7.5 (high), 2026-07-14: Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
CVE-2026-50304 - CVSS 7.5 (high), 2026-07-14: Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
CVE-2026-50653 - CVSS 7.5 (high), 2026-07-14: Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.
CVE-2026-50652 - CVSS 7.5 (high), 2026-07-14: Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.
CVE-2026-35433 - CVSS 7.3 (high), 2026-05-12: Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-32177 - CVSS 7.3 (high), 2026-05-12: Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-33116 - CVSS 7.5 (high), 2026-04-14: Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.
CVE-2026-32226 - CVSS 5.9 (medium), 2026-04-14: Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service…
CVE-2026-23666 - CVSS 7.5 (high), 2026-04-14: Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2025-55248 - CVSS 5.7 (medium), 2025-10-14: Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.
CVE-2025-21176 - CVSS 8.8 (high), 2025-01-14: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE-2024-43484 - CVSS 7.5 (high), 2024-10-08: .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
CVE-2024-43483 - CVSS 7.5 (high), 2024-10-08: .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
CVE-2024-38081 - CVSS 7.3 (high), 2024-07-09: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVE-2024-21409 - CVSS 7.3 (high), 2024-04-09: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE-2024-29059 - CVSS 7.5 (high), 2024-03-23: .NET Framework Information Disclosure Vulnerability
CVE-2024-21312 - CVSS 7.5 (high), 2024-01-09: .NET Framework Denial of Service Vulnerability
CVE-2024-0056 - CVSS 8.7 (high), 2024-01-09: Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
CVE-2024-0057 - CVSS 9.8 (critical), 2024-01-09: NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
CVE-2023-36049 - CVSS 9.8 (critical), 2023-11-14: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVE-2023-36560 - CVSS 8.8 (high), 2023-11-14: ASP.NET Security Feature Bypass Vulnerability
CVE-2023-36796 - CVSS 7.8 (high), 2023-09-12: Visual Studio Remote Code Execution Vulnerability
CVE-2023-36792 - CVSS 7.8 (high), 2023-09-12: Visual Studio Remote Code Execution Vulnerability
CVE-2023-36788 - CVSS 7.8 (high), 2023-09-12: .NET Framework Remote Code Execution Vulnerability
CVE-2023-36794 - CVSS 7.8 (high), 2023-09-12: Visual Studio Remote Code Execution Vulnerability
CVE-2023-36793 - CVSS 7.8 (high), 2023-09-12: Visual Studio Remote Code Execution Vulnerability
CVE-2023-36873 - CVSS 7.4 (high), 2023-08-08: .NET Framework Spoofing Vulnerability
CVE-2023-36899 - CVSS 8.8 (high), 2023-08-08: ASP.NET Elevation of Privilege Vulnerability
CVE-2023-29326 - CVSS 7.8 (high), 2023-06-14: .NET Framework Remote Code Execution Vulnerability
CVE-2023-24936 - CVSS 7.5 (high), 2023-06-14: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVE-2023-32030 - CVSS 7.5 (high), 2023-06-14: .NET and Visual Studio Denial of Service Vulnerability
CVE-2023-24897 - CVSS 7.8 (high), 2023-06-14: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE-2023-29331 - CVSS 7.5 (high), 2023-06-14: .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
CVE-2023-24895 - CVSS 7.8 (high), 2023-06-14: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE-2023-21808 - CVSS 7.8 (high), 2023-02-14: .NET and Visual Studio Remote Code Execution Vulnerability
CVE-2023-21722 - CVSS 5 (medium), 2023-02-14: .NET Framework Denial of Service Vulnerability
CVE-2022-41089 - CVSS 7.8 (high), 2022-12-13: .NET Framework Remote Code Execution Vulnerability
CVE-2022-41064 - CVSS 5.8 (medium), 2022-11-09: .NET Framework Information Disclosure Vulnerability
CVE-2022-26929 - CVSS 7.8 (high), 2022-09-13: .NET Framework Remote Code Execution Vulnerability
CVE-2022-30130 - CVSS 5.5 (medium), 2022-05-10: .NET Framework Denial of Service Vulnerability
CVE-2022-26832 - CVSS 7.5 (high), 2022-04-15: .NET Framework Denial of Service Vulnerability
CVE-2022-21911 - CVSS 7.5 (high), 2022-01-11: .NET Framework Denial of Service Vulnerability
CVE-2021-24111 - CVSS 7.5 (high), 2021-02-25: .NET Framework Denial of Service Vulnerability
CVE-2020-16937 - CVSS 5.5 (medium), 2020-10-16: <p>An information disclosure vulnerability exists when the .NET Framework improperly handles objects in memory. An attacker who successfully exploited the…
CVE-2020-1476 - CVSS 5.5 (medium), 2020-08-17: An elevation of privilege vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow access to cached files. An attacker who…
CVE-2020-1046 - CVSS 7.8 (high), 2020-08-17: A remote code execution vulnerability exists when Microsoft .NET Framework processes input. An attacker who successfully exploited this vulnerability could…
CVE-2020-1147 - CVSS 7.8 (high), 2020-07-14: A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of…
CVE-2020-1108 - CVSS 7.5 (high), 2020-05-21: A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this…
CVE-2020-1066 - CVSS 7.8 (high), 2020-05-21: An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level. To exploit the vulnerability,…
CVE-2020-0646 - CVSS 9.8 (critical), 2020-01-14: A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution…
CVE-2020-0606 - CVSS 8.8 (high), 2020-01-14: A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully…
CVE-2020-0605 - CVSS 8.8 (high), 2020-01-14: A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully…
CVE-2019-1142 - CVSS 5.5 (medium), 2019-09-11: An elevation of privilege vulnerability exists when the .NET Framework common language runtime (CLR) allows file creation in arbitrary locations, aka '.NET…
CVE-2019-1113 - CVSS 8.8 (high), 2019-07-15: A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully…
CVE-2019-1083 - CVSS 7.5 (high), 2019-07-15: A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests, aka '.NET Denial of Service…
CVE-2019-1006 - CVSS 7.5 (high), 2019-07-15: An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens…
CVE-2019-0981 - CVSS 7.5 (high), 2019-05-16: A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service…
CVE-2019-0980 - CVSS 7.5 (high), 2019-05-16: A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service…
CVE-2019-0820 - CVSS 7.5 (high), 2019-05-16: A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of…
CVE-2019-0864 - CVSS 5.5 (medium), 2019-05-16: A denial of service vulnerability exists when .NET Framework improperly handles objects in heap memory, aka '.NET Framework Denial of Service Vulnerability'.
CVE-2019-11397 - CVSS 6.5 (medium), 2019-05-14: GetFile.aspx in Rapid4 RapidFlows Enterprise Application Builder 4.5M.23 (when used with .NET Framework 4.5) allows Local File Inclusion via the FileDesc…
CVE-2019-0657 - CVSS 5.9 (medium), 2019-03-05: A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing…
CVE-2019-0613 - CVSS 8.8 (high), 2019-03-05: A remote code execution vulnerability exists in .NET Framework and Visual Studio software when the software fails to check the source markup of a file.An…