.NET Core Remote Code Execution Vulnerability

ALTO 8.1CVE-2021-24112 · BIT-dotnet-2021-24112 · BIT-dotnet-sdk-2021-24112 · Published 25/02/2021 · updated 07/10/2026

In breve

CVE-2021-24112 è una vulnerabilità ALTO (CVSS 8.1) che riguarda System.Drawing.Common, .net (microsoft), .net core (microsoft).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.5%, superiore al 89.0% delle vulnerabilità.
Correzione: aggiornare a 4.7.2, 5.0.3, 6.12.0.122 o successiva.

Package	Affected versions	Patched versions
System.Drawing.Common NuGet	`≥ 4.0.0, < 4.7.2≥ 5.0.0, < 5.0.3`	`4.7.25.0.3`
.net microsoft	`≥ 5.0, ≤ 5.0.2`	No fix yet
.net core microsoft	`≥ 2.1, ≤ 2.1.24≥ 3.1, ≤ 3.1.11`	No fix yet
mono microsoft	`≥ 6.12.0, < 6.12.0.122`	`6.12.0.122`

Description

A remote code execution vulnerability exists when parsing certain types of graphics files. This vulnerability only exists on systems running on MacOS or Linux. This CVE ID is unique from CVE-2021-26701.

NVD description

.NET Core Remote Code Execution Vulnerability

References

nvd.nist.gov/vuln/detail/CVE-2021-24112 · ADVISORY
dotnet/announcements · WEB
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24112 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free