A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who su

Summary

A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.

Timeline

1. Jan 14, 2020, 11:11 PM UTCCVE published
2. Aug 4, 2024, 6:11 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Microsoft ASP.NET Core

  2.1, 3.0, 3.1

• Microsoft.AspNetCore.AllNuGet

  From 2.1.0 · fixed in 2.1.15

• Microsoft.AspNetCore.AppNuGet

  From 3.1.0 · fixed in 3.1.1

• Microsoft.AspNetCore.AppNuGet

  From 3.0.0 · fixed in 3.0.1

• Microsoft.AspNetCore.AppNuGet

  From 2.1.0 · fixed in 2.1.15

• Microsoft.AspNetCore.Http.ConnectionsNuGet

  From 1.0.0 · fixed in 1.0.15

• Microsoft.AspNetCore.App.Runtime.linux-armNuGet

  From 3.1.0 · fixed in 3.1.1

• Microsoft.AspNetCore.App.Runtime.linux-arm64NuGet

  From 3.1.0 · fixed in 3.1.1

• Microsoft.AspNetCore.App.Runtime.linux-musl-arm64NuGet

  From 3.1.0 · fixed in 3.1.1

• Microsoft.AspNetCore.App.Runtime.linux-musl-x64NuGet

  From 3.1.0 · fixed in 3.1.1

• Microsoft.AspNetCore.App.Runtime.linux-x64NuGet

  From 3.1.0 · fixed in 3.1.1

• Microsoft.AspNetCore.App.Runtime.osx-x64NuGet

  From 3.1.0 · fixed in 3.1.1

• Microsoft.AspNetCore.App.Runtime.win-armNuGet

  From 3.1.0 · fixed in 3.1.1

• Microsoft.AspNetCore.App.Runtime.win-x64NuGet

  From 3.1.0 · fixed in 3.1.1

• Microsoft.AspNetCore.App.Runtime.win-x86NuGet

  From 3.1.0 · fixed in 3.1.1

References 3