VYPR
← All advisories
Moderate severityNVD Advisory· Published May 14, 2024· Updated May 3, 2025

.NET and Visual Studio Remote Code Execution Vulnerability

CVE-2024-30045

Description

.NET and Visual Studio Remote Code Execution Vulnerability

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A stack buffer overrun in .NET's Double Parse routine allows remote code execution in .NET 7.0 and 8.0.

Vulnerability

Overview

The vulnerability exists in .NET's Double.Parse routine, where a stack buffer overrun can occur [1][2]. This memory corruption bug can be triggered by specially crafted input, potentially leading to arbitrary code execution. The issue affects .NET 7.0 (up to version 7.0.18) and .NET 8.0 (up to version 8.0.4) [1][2][3].

Exploitation

An attacker would need to supply a malicious double-precision floating-point string to an application that uses the affected parsing routine. No authentication or user interaction is required beyond the application processing the malformed input [2][3]. The vulnerability is classified as remote code execution because it allows an unauthenticated remote attacker to compromise a vulnerable system [1][4].

Impact

Successful exploitation grants the attacker the ability to execute arbitrary code in the context of the application. This could lead to full system compromise, including data theft, installation of malware, or further lateral movement within a network [1][2].

Mitigation

Microsoft has released patches for the affected packages: update .NET 7.0 to version 7.0.19 and .NET 8.0 to version 8.0.5 [1][2][3]. No workarounds are available [3]. Developers should update their applications to use the patched runtime packages.

References
  1. Microsoft Security Advisory CVE-2024-30045 | .NET Remote code Execution Vulnerability
  2. Microsoft Security Advisory CVE-2024-30045 | .NET Remote code Execution Vulnerability
  3. Microsoft Security Advisory CVE-2024-30045 | .NET Remote code Execution Vulnerability
  4. NVD - CVE-2024-30045

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.NETCore.App.Runtime.linux-armNuGet
>= 7.0.0, < 7.0.197.0.19
Microsoft.NETCore.App.Runtime.linux-arm64NuGet
>= 7.0.0, < 7.0.197.0.19
Microsoft.NETCore.App.Runtime.linux-armNuGet
>= 8.0.0, < 8.0.58.0.5
Microsoft.NETCore.App.Runtime.linux-arm64NuGet
>= 8.0.0, < 8.0.58.0.5
Microsoft.NETCore.App.Runtime.linux-musl-armNuGet
>= 7.0.0, < 7.0.197.0.19
Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet
>= 8.0.0, < 8.0.58.0.5
Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet
>= 7.0.0, < 7.0.197.0.19
Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet
>= 8.0.0, < 8.0.58.0.5
Microsoft.NETCore.App.Runtime.linux-x64NuGet
>= 7.0.0, < 7.0.197.0.19
Microsoft.NETCore.App.Runtime.linux-x64NuGet
>= 8.0.0, < 8.0.58.0.5
Microsoft.NETCore.App.Runtime.osx-arm64NuGet
>= 7.0.0, < 7.0.197.0.19
Microsoft.NETCore.App.Runtime.osx-arm64NuGet
>= 8.0.0, < 8.0.58.0.5
Microsoft.NETCore.App.Runtime.osx-x64NuGet
>= 7.0.0, < 7.0.197.0.19
Microsoft.NETCore.App.Runtime.osx-x64NuGet
>= 8.0.0, < 8.0.58.0.5
Microsoft.NETCore.App.Runtime.win-armNuGet
>= 7.0.0, < 7.0.197.0.19
Microsoft.NETCore.App.Runtime.win-armNuGet
>= 8.0.0, < 8.0.58.0.5
Microsoft.NETCore.App.Runtime.win-arm64NuGet
>= 7.0.0, < 7.0.197.0.19
Microsoft.NETCore.App.Runtime.win-arm64NuGet
>= 8.0.0, < 8.0.58.0.5
Microsoft.NETCore.App.Runtime.win-x64NuGet
>= 7.0.0, < 7.0.197.0.19
Microsoft.NETCore.App.Runtime.win-x64NuGet
>= 8.0.0, < 8.0.58.0.5
Microsoft.NETCore.App.Runtime.win-x86NuGet
>= 7.0.0, < 7.0.197.0.19
Microsoft.NETCore.App.Runtime.win-x86NuGet
>= 8.0.0, < 8.0.58.0.5
Microsoft.NETCore.App.Runtime.linux-musl-armNuGet
>= 8.0.0, < 8.0.58.0.5
Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet
>= 7.0.0, < 7.0.197.0.19

Affected products

46

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.