TI-2024-14169 Aliases CVE-2024-21409 GHSA-6qmx-42h2-j8h6

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

LOW 39CWE-416Published 2024-04-09 · Updated 2025-05-03

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Microsoft. Impact type from Microsoft.

Summary

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.02513 84th percentileScored 2026-11-07

Fix Fixed Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet): 6.0.29, 8.0.4, 7.0.18Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet): 6.0.29, 8.0.4, 7.0.18+1 more productMicrosoft: 17 updates

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Microsoft Visual Studio 2022 version 17.9	17.0 to before 17.9.6	17.9.6	Patch available	CNA
Microsoft	Microsoft Visual Studio 2022 version 17.4	17.4.0 to before 17.4.18	17.4.18	Patch available	CNA
Microsoft	Microsoft Visual Studio 2022 version 17.6	17.6.0 to before 17.6.14	17.6.14	Patch available	CNA
Microsoft	Microsoft Visual Studio 2022 version 17.8	17.8.0 to before 17.8.9	17.8.9	Patch available	CNA
Microsoft	PowerShell 7.3	7.3.0 to before 7.3.12	7.3.12	Patch available	CNA
Microsoft	PowerShell 7.4	7.4.0 to before 7.4.2	7.4.2	Patch available	CNA
Microsoft	PowerShell 7.2	7.2.0 to before 7.2.19	7.2.19	Patch available	CNA
Microsoft	.NET 6.0	6.0.0 to before 6.0.29	6.0.29	Patch available	CNA
Microsoft	.NET 7.0	7.0.0 to before 7.0.18	7.0.18	Patch available	CNA
Microsoft	.NET 8.0	8.0 to before 8.0.4	8.0.4	Patch available	CNA
Microsoft	Microsoft .NET Framework 4.8	4.8.0 to before 4.8.4718.0	4.8.4718.0	Patch available	CNA
Microsoft	Microsoft .NET Framework 3.5 AND 4.8	4.8.0 to before 4.8.4718.0	4.8.4718.0	Patch available	CNA
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2	4.7.0 to before 4.7.4092.0	4.7.4092.0	Patch available	CNA
Microsoft	Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2	4.7.0 to before 4.7.4092.0	4.7.4092.0	Patch available	CNA
Microsoft	Microsoft .NET Framework 3.5 AND 4.8.1	4.8.1 to before 4.8.9236.0	4.8.9236.0	Patch available	CNA
Microsoft	Microsoft .NET Framework 4.6.2	4.7.0 to before 4.7.4092.0	4.7.4092.0	Patch available	CNA
—	Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet)	before 6.0.29	6.0.29	Patch available	GHSA-6qmx-42h2-j8h6
—	Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet)	8.0.0 to before 8.0.4	8.0.4	Patch available	GHSA-6qmx-42h2-j8h6
—	Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet)	7.0.0 to before 7.0.18	7.0.18	Patch available	GHSA-6qmx-42h2-j8h6
—	Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet)	before 6.0.29	6.0.29	Patch available	GHSA-6qmx-42h2-j8h6
—	Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet)	8.0.0 to before 8.0.4	8.0.4	Patch available	GHSA-6qmx-42h2-j8h6
—	Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet)	7.0.0 to before 7.0.18	7.0.18	Patch available	GHSA-6qmx-42h2-j8h6
—	Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet)	7.0.0 to before 7.0.18	7.0.18	Patch available	GHSA-6qmx-42h2-j8h6
—	Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet)	8.0.0 to before 8.0.4	8.0.4	Patch available	GHSA-6qmx-42h2-j8h6
—	Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet)	before 6.0.29	6.0.29	Patch available	GHSA-6qmx-42h2-j8h6

Microsoft Visual Studio 2022 version 17.9 VendorMicrosoft Affected 17.0 to before 17.9.6 Fixed in 17.9.6 Patch available CNA
Microsoft Visual Studio 2022 version 17.4 VendorMicrosoft Affected 17.4.0 to before 17.4.18 Fixed in 17.4.18 Patch available CNA
Microsoft Visual Studio 2022 version 17.6 VendorMicrosoft Affected 17.6.0 to before 17.6.14 Fixed in 17.6.14 Patch available CNA
Microsoft Visual Studio 2022 version 17.8 VendorMicrosoft Affected 17.8.0 to before 17.8.9 Fixed in 17.8.9 Patch available CNA
PowerShell 7.3 VendorMicrosoft Affected 7.3.0 to before 7.3.12 Fixed in 7.3.12 Patch available CNA
PowerShell 7.4 VendorMicrosoft Affected 7.4.0 to before 7.4.2 Fixed in 7.4.2 Patch available CNA
PowerShell 7.2 VendorMicrosoft Affected 7.2.0 to before 7.2.19 Fixed in 7.2.19 Patch available CNA
.NET 6.0 VendorMicrosoft Affected 6.0.0 to before 6.0.29 Fixed in 6.0.29 Patch available CNA
.NET 7.0 VendorMicrosoft Affected 7.0.0 to before 7.0.18 Fixed in 7.0.18 Patch available CNA
.NET 8.0 VendorMicrosoft Affected 8.0 to before 8.0.4 Fixed in 8.0.4 Patch available CNA
Microsoft .NET Framework 4.8 VendorMicrosoft Affected 4.8.0 to before 4.8.4718.0 Fixed in 4.8.4718.0 Patch available CNA
Microsoft .NET Framework 3.5 AND 4.8 VendorMicrosoft Affected 4.8.0 to before 4.8.4718.0 Fixed in 4.8.4718.0 Patch available CNA
Microsoft .NET Framework 3.5 AND 4.7.2 VendorMicrosoft Affected 4.7.0 to before 4.7.4092.0 Fixed in 4.7.4092.0 Patch available CNA
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 VendorMicrosoft Affected 4.7.0 to before 4.7.4092.0 Fixed in 4.7.4092.0 Patch available CNA
Microsoft .NET Framework 3.5 AND 4.8.1 VendorMicrosoft Affected 4.8.1 to before 4.8.9236.0 Fixed in 4.8.9236.0 Patch available CNA
Microsoft .NET Framework 4.6.2 VendorMicrosoft Affected 4.7.0 to before 4.7.4092.0 Fixed in 4.7.4092.0 Patch available CNA
Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) Vendor— Affected before 6.0.29 Fixed in 6.0.29 Patch available GHSA-6qmx-42h2-j8h6
Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.4 Fixed in 8.0.4 Patch available GHSA-6qmx-42h2-j8h6
Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) Vendor— Affected 7.0.0 to before 7.0.18 Fixed in 7.0.18 Patch available GHSA-6qmx-42h2-j8h6
Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet) Vendor— Affected before 6.0.29 Fixed in 6.0.29 Patch available GHSA-6qmx-42h2-j8h6
Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.4 Fixed in 8.0.4 Patch available GHSA-6qmx-42h2-j8h6
Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet) Vendor— Affected 7.0.0 to before 7.0.18 Fixed in 7.0.18 Patch available GHSA-6qmx-42h2-j8h6
Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) Vendor— Affected 7.0.0 to before 7.0.18 Fixed in 7.0.18 Patch available GHSA-6qmx-42h2-j8h6
Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) Vendor— Affected 8.0.0 to before 8.0.4 Fixed in 8.0.4 Patch available GHSA-6qmx-42h2-j8h6
Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) Vendor— Affected before 6.0.29 Fixed in 6.0.29 Patch available GHSA-6qmx-42h2-j8h6

CPE configurations NVD · 25

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:.net_framework:3.5:-::::::	3.5	Vulnerable	Microsoft
cpe:2.3:a:microsoft:.net_framework:4.8.1:::::::*	4.8.1	Vulnerable	Microsoft
cpe:2.3:o:microsoft:windows_10_21h2:-:::::::*	not specified by NVD	Running on	Microsoft
cpe:2.3:o:microsoft:windows_10_22h2:-:::::::*	not specified by NVD	Running on	Microsoft
cpe:2.3:o:microsoft:windows_11_21h2:-:::::::*	not specified by NVD	Running on	Microsoft
cpe:2.3:o:microsoft:windows_11_22h2:-:::::::*	not specified by NVD	Running on	Microsoft
cpe:2.3:o:microsoft:windows_11_23h2:-:::::::*	not specified by NVD	Running on	Microsoft
cpe:2.3:o:microsoft:windows_server_2022:-:::::::*	not specified by NVD	Running on	Microsoft
cpe:2.3:a:microsoft:.net::::::::	6.0.0 to before 6.0.29; 7.0.0 to before 7.0.18; 8.0.0 to before 8.0.4	Vulnerable	Microsoft
cpe:2.3:a:microsoft:powershell::::::::	7.2 to before 7.2.19; 7.3 to before 7.3.12; 7.4 to before 7.4.2	Vulnerable	Microsoft

cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:* Versions 3.5 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:* Versions 4.8.1 Vulnerable ·Microsoft
cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* Versions 6.0.0 to before 6.0.29; 7.0.0 to before 7.0.18; 8.0.0 to before 8.0.4 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:* Versions 7.2 to before 7.2.19; 7.3 to before 7.3.12; 7.4 to before 7.4.2 Vulnerable ·Microsoft

Show 15 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:visual_studio_2022::::::::	17.4.0 to before 17.4.18; 17.6.0 to before 17.6.14; 17.8.0 to before 17.8.9; 17.9.0 to before 17.9.6	Vulnerable	Microsoft
cpe:2.3:a:microsoft:.net_framework:4.7.2:::::::*	4.7.2	Vulnerable	Microsoft
cpe:2.3:o:microsoft:windows_10_1607:-:::::::*	not specified by NVD	Running on	Microsoft
cpe:2.3:o:microsoft:windows_10_1809:-:::::::*	not specified by NVD	Running on	Microsoft
cpe:2.3:o:microsoft:windows_server_2016:-:::::::*	not specified by NVD	Running on	Microsoft
cpe:2.3:o:microsoft:windows_server_2019:-:::::::*	not specified by NVD	Running on	Microsoft
cpe:2.3:a:microsoft:.net_framework:4.8:::::::*	4.8	Vulnerable	Microsoft
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:*	r2 sp1	Running on	Microsoft
cpe:2.3:o:microsoft:windows_server_2012:-:::::::*	not specified by NVD	Running on	Microsoft
cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*	r2	Running on	Microsoft
cpe:2.3:a:microsoft:.net_framework:4.6.2:::::::*	4.6.2	Vulnerable	Microsoft
cpe:2.3:a:microsoft:.net_framework:4.7:::::::*	4.7	Vulnerable	Microsoft
cpe:2.3:a:microsoft:.net_framework:4.7.1:::::::*	4.7.1	Vulnerable	Microsoft
cpe:2.3:a:microsoft:.net_framework:3.5:::::::*	3.5	Vulnerable	Microsoft
cpe:2.3:o:microsoft:windows_server_2008:-:sp2::::::	not specified by NVD	Running on	Microsoft

cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* Versions 17.4.0 to before 17.4.18; 17.6.0 to before 17.6.14; 17.8.0 to before 17.8.9; 17.9.0 to before 17.9.6 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* Versions 4.7.2 Vulnerable ·Microsoft
cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:* Versions 4.8 Vulnerable ·Microsoft
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* Versions r2 sp1 Running on ·Microsoft
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* Versions 4.6.2 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* Versions 4.7.1 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Microsoft
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

Fix · GHSA-6qmx-42h2-j8h6 Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) Fixed in 6.0.29 Advisory →
Fix · GHSA-6qmx-42h2-j8h6 Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) Fixed in 8.0.4 Advisory →
Fix · GHSA-6qmx-42h2-j8h6 Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) Fixed in 7.0.18 Advisory →
Fix · GHSA-6qmx-42h2-j8h6 Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet) Fixed in 6.0.29 Advisory →
Fix · GHSA-6qmx-42h2-j8h6 Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet) Fixed in 8.0.4 Advisory →
Fix · GHSA-6qmx-42h2-j8h6 Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet) Fixed in 7.0.18 Advisory →
Fix · GHSA-6qmx-42h2-j8h6 Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) Fixed in 7.0.18 Advisory →
Fix · GHSA-6qmx-42h2-j8h6 Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) Fixed in 8.0.4 Advisory →
Fix · GHSA-6qmx-42h2-j8h6 Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) Fixed in 6.0.29 Advisory →

Microsoft 17 updates

KB5037338
Security Update
- .NET 8.0 8.0.4
KB5037337
Security Update
- .NET 7.0 7.0.18
KB5037336
Security Update
- .NET 6.0 6.0.29

Show 14 more Microsoft updates

KB5037128
Security Only
- Microsoft .NET Framework 4.6.2 4.7.4092.0
KB5037127
Security Only
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.4092.0
- Microsoft .NET Framework 4.8 4.8.4718.0
KB5037041
Monthly Rollup
- Microsoft .NET Framework 4.6.2 4.7.4092.0
KB5037040
Monthly Rollup
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.4092.0
- Microsoft .NET Framework 4.8 4.8.4718.0
KB5037039
Monthly Rollup
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.4092.0
- Microsoft .NET Framework 4.8 4.8.4718.0
KB5037038
Monthly Rollup
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.4092.0
KB5037037
Security Update
- Microsoft .NET Framework 3.5 AND 4.8 4.8.4718.0
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.9206.0, 4.8.9236.0
KB5037036
Security Update
- Microsoft .NET Framework 3.5 AND 4.8 4.8.4718.0
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.9236.0
KB5037035
Security Update
- Microsoft .NET Framework 3.5 AND 4.8 4.8.4718.0
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.9236.0
KB5037034
Security Update
- Microsoft .NET Framework 3.5 AND 4.7.2 4.7.4092.0
- Microsoft .NET Framework 3.5 AND 4.8 4.8.4718.0
KB5037033
Security Update
- Microsoft .NET Framework 3.5 AND 4.8 4.8.4718.0
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.9236.0
KB5036899
Security Update
- Microsoft .NET Framework 3.5 AND 4.7.2 10.0.14393.6897
- Windows 10 Version 1607 for 32-bit Systems 10.0.14393.6897
- Windows 10 Version 1607 for x64-based Systems 10.0.14393.6897
- Windows Server 2016 10.0.14393.6897
- Windows Server 2016 (Server Core installation) 10.0.14393.6897
KB5036620
Security Update
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.9236.0
KB5036609
Security Update
- Microsoft .NET Framework 3.5 AND 4.8 4.8.4718.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products

.NET 6.0 on Red Hat Enterprise Linux
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Microsoft

Microsoft's page for this CVE →

Impact: Remote Code Execution
Exploited: No
Publicly disclosed: No
Exploitability: Exploitation Less Likely

Product	Status	Plan or fix
Microsoft Visual Studio 2022 version 17.4	Fixed	17.4.18 · Security Update
Microsoft Visual Studio 2022 version 17.6	Fixed	17.6.14 · Security Update
Microsoft Visual Studio 2022 version 17.8	Fixed	17.8.9 · Security Update
Microsoft Visual Studio 2022 version 17.9	Fixed	17.9.6 · Security Update
PowerShell 7.2	Fixed	7.2.19 · Security Update
PowerShell 7.3	Fixed	7.3.12 · Security Update
PowerShell 7.4	Fixed	7.4.2 · Security Update

Timeline

2026-10-02 Threatist record created from CVE-2024-21409
2026-10-03 Alias added: GHSA-6qmx-42h2-j8h6

References

Advisory 2

Other 3

TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
TI-2023-19588 Microsoft QUIC Denial of Service Vulnerability CVSS 3.1HIGH 7.5
TI-2024-14152 .NET and Visual Studio Denial of Service Vulnerability CVSS 3.1HIGH 7.5
TI-2021-08380 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8

See all 129 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Key facts

Summary

Why it matters now

SSVC decision points

Affected products

CPE configurations NVD · 25

Remediation

Microsoft 17 updates

Vendor assessments

Red Hat

Microsoft

Timeline

References

Advisory 2

Other 3

More Microsoft .net vulnerabilities

Sources