.NET Framework Information Disclosure Vulnerability

Summary

The vulnerability affects Microsoft's .NET Framework, a software development platform used to build and run Windows applications. An attacker who exploits it could potentially access sensitive information that should be restricted.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Timeline

1. Mar 22, 2024, 11:09 PM UTCCVE published
2. Feb 4, 2025Added to CISA KEV

   CISA has evidence of exploitation in the wild

3. Feb 25, 2025CISA remediation deadline

   Due date for US federal agencies to patch

4. Oct 21, 2025, 11:05 PM UTCRecord last updated
5. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Microsoft Microsoft .NET Framework 4.8

  From 4.8.0 · fixed in 4.8.04690.02

• Microsoft Microsoft .NET Framework 3.5 AND 4.8

  From 4.8.0 · fixed in 4.8.04690.02

• Microsoft Microsoft .NET Framework 3.5 AND 4.7.2

  From 4.7.0 · fixed in 4.7.04081.03

• Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2

  From 4.7.0 · fixed in 4.7.04081.03

• Microsoft Microsoft .NET Framework 3.5 AND 4.8.1

  From 4.8.1 · fixed in 4.8.09214.01

• Microsoft Microsoft .NET Framework 4.6.2

  From 4.7.0 · fixed in 4.7.04081.03

• Microsoft Microsoft .NET Framework 3.5 AND 4.6/4.6.2

  From 10.0.0 · fixed in 10.0.10240.20402

• Microsoft Microsoft .NET Framework 2.0 Service Pack 2

  From 2.0.0 · fixed in 3.0.50727.8976

• Microsoft Microsoft .NET Framework 3.0 Service Pack 2

  From 3.0.0 · fixed in 3.0.50727.8976

• Microsoft Microsoft .NET Framework 3.5

  From 3.5.0 · fixed in 3.0.50727.8976

• Microsoft Microsoft .NET Framework 3.5.1

  From 3.5.0 · fixed in 3.0.30729.8959

References 1