VYPR
← All advisories
High severityNVD Advisory· Published Jun 14, 2023· Updated Jan 1, 2025

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

CVE-2023-24936

Description

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A vulnerability in .NET DataSet/DataTable XML deserialization can lead to elevation of privilege when custom types are allowed.

Vulnerability

Overview CVE-2023-24936 is an elevation of privilege vulnerability in .NET, .NET Framework, and Visual Studio. The root cause lies in the deserialization of XML data into DataSet or DataTable objects. By default, these classes use a restricted allow-list of types, but when a developer or administrator extends this list to include specific types, an attacker can craft malicious XML that triggers unauthorized actions during deserialization. [1][2]

Exploitation

Conditions Exploitation requires the application to use a custom allow-list for DataSet or DataTable deserialization. Without this configuration, the default protections prevent the vulnerability. An attacker must supply a specially crafted XML payload to a vulnerable application, potentially over the network if the service processes untrusted data. No authentication is mentioned as a prerequisite for the deserialization itself, but the attack surface depends on where the XML is deserialized. [1][2]

Impact

Successful exploitation results in elevation of privilege, allowing the attacker to perform operations beyond their intended permissions. The exact scope depends on the context of the application, but it could lead to arbitrary code execution or data access with elevated rights. [1][2]

Mitigation

The vulnerability affects .NET 7.0 versions prior to 7.0.5 and .NET 6.0 versions prior to 6.0.16. Patches are available in .NET 7.0.7 and .NET 6.0.18 respectively. Developers should update their .NET runtime and any affected packages (e.g., Microsoft.NetCore.App.Runtime) to the patched versions. As a workaround, use the default allow-list without extending it with untrusted types. [1][2]

References
  1. Microsoft Security Advisory CVE-2023-24936: .NET Elevation of Privilege Vulnerability
  2. Microsoft Security Advisory CVE-2023-24936: .NET Elevation of Privilege Vulnerability

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.NETCore.App.Runtime.linux-armNuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.linux-arm64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.linux-musl-armNuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.linux-x64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.osx-arm64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.osx-x64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.win-armNuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.win-arm64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.win-x64NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.win-x86NuGet
>= 7.0.0, < 7.0.77.0.7
Microsoft.NETCore.App.Runtime.linux-armNuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.linux-arm64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.linux-musl-armNuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.linux-x64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.osx-arm64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.osx-x64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.win-armNuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.win-arm64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.win-x64NuGet
>= 6.0.0, < 6.0.186.0.18
Microsoft.NETCore.App.Runtime.win-x86NuGet
>= 6.0.0, < 6.0.186.0.18

Affected products

55

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.