.NET 10.0 vulnerability

What happened

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

Affected versions

.NET 10.0: 10.0.0 through before 10.0.12 (custom); 11.0.0 through before 11.0 RC1 (custom); 8.0.0 through before 8.0.31 (custom); 9.0.0 through before 9.0.20 (custom); 3.0.0.0 through before 2.0.50727.8984 & 3.0.30729.8980 & 4.7.4145.0 (custom); 4.7.0 through before 2.0.50727.9070 & 3.0.30729.9068 & 4.7.4145.0 (custom); 4.8.0 through before 2.0.50727.9070 & 3.0.30729.9068 & 4.8.4806.0 (custom); 4.8.1 through before 2.0.50727.9183 & 3.0.30729.9169 & 4.8.9347.0 (custom); 4.7.0 through before 4.7.4145.0 (custom); 4.8.0 through before 4.8.4806.0 (custom); 4.8.0.0 through before 4.8.9347.0 (custom); 17.14.0 through before 17.14.40 (custom); 18.9.0 through before 18.9.3 (custom) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.