Dec 2022: .NET Framework Remote Code Execution Vulnerability
CVE-2022-41089 Published on December 13, 2022

Products Associated with CVE-2022-41089

Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.

Affected Versions

Microsoft Visual Studio 2022 version 17.2:

• Version 17.2.0 and below 17.2.11 is affected.

Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10):

• Version 16.11.0 and below 16.11.22 is affected.

Microsoft Visual Studio 2022 version 17.0:

• Version 17.0.0 and below 17.0.17 is affected.

Microsoft Visual Studio 2022 version 17.4:

• Version 17.4.0 and below 17.4.3 is affected.

Microsoft .NET 6.0:

• Version 6.0.0 and below 6.0.12 is affected.

Microsoft .NET Core 3.1:

• Version 3.1 and below 3.1.32 is affected.

Microsoft .NET 7.0:

• Version 7.0.0 and below 7.0.1 is affected.

Microsoft PowerShell 7.2:

• Version 7.2.0 and below 7.2.9 is affected.

Microsoft PowerShell 7.3:

• Version 7.3.0 and below 7.3.2 is affected.

Microsoft .NET Framework 4.8:

• Version 4.8.0 and below 04590.02 is affected.

Microsoft .NET Framework 3.5 AND 4.8:

• Version 4.8.0 and below 04590.02 is affected.

Microsoft .NET Framework 3.5 AND 4.7.2:

• Version 4.7.0 and below 04010.02 is affected.

Microsoft .NET Framework 3.5 AND 4.8.1:

• Version 4.8.1 and below 09115.01 is affected.

Microsoft .NET Framework 2.0 Service Pack 2:

• Version 2.0.0 and below 30729.8953 is affected.

Microsoft .NET Framework 3.0 Service Pack 2:

• Version 3.0.0 and below 30729.8953 is affected.

Microsoft .NET Framework 3.5:

• Version 3.5.0 and below 30729.8953 is affected.

Microsoft .NET Framework 3.5.1:

• Version 3.5.0 and below 30729.8953 is affected.

Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2:

• Version 4.7.0 and below 04010.02 is affected.

Microsoft .NET Framework 4.6.2:

• Version 4.7.0 and below 04010.02 is affected.

Microsoft .NET Framework 3.5 AND 4.6/4.6.2:

• Version 10.0.0 and below 10.0.10240.19624 is affected.

Vulnerable Packages

The following package name and versions may be associated with CVE-2022-41089

Package Manager	Vulnerable Package	Versions	Fixed In
nuget	Microsoft.WindowsDesktop.App.Runtime.win-arm64	>= 6.0.0, <= 6.0.11	6.0.12
nuget	Microsoft.WindowsDesktop.App.Runtime.win-x64	>= 6.0.0, <= 6.0.11	6.0.12
nuget	Microsoft.WindowsDesktop.App.Runtime.win-x86	>= 6.0.0, <= 6.0.11	6.0.12
nuget	Microsoft.WindowsDesktop.App.Runtime.win-arm64	= 7.0.0	7.0.1
nuget	Microsoft.WindowsDesktop.App.Runtime.win-x86	= 7.0.0	7.0.1
nuget	Microsoft.WindowsDesktop.App.Runtime.win-x64	= 7.0.0	7.0.1
nuget	Microsoft.WindowsDesktop.App.Runtime.win-x86	>= 3.1.0, <= 3.1.31	3.1.32
nuget	Microsoft.WindowsDesktop.App.Runtime.win-x64	>= 3.1.0, <= 3.1.31	3.1.32

Exploit Probability