VYPR
← All advisories
High severityNVD Advisory· Published Oct 8, 2024· Updated Jul 8, 2025

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

CVE-2024-43484

Description

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A denial of service vulnerability in .NET's System.IO.Packaging library allows untrusted inputs to trigger algorithmically complex operations, crashing the application.

Vulnerability

Overview

CVE-2024-43484 is a denial of service vulnerability affecting .NET, .NET Framework, and Visual Studio, specifically within the System.IO.Packaging library. The root cause is that the library may allow untrusted inputs to influence algorithmically complex operations, leading to excessive resource consumption and a denial of service condition [1][2]. Microsoft has not identified any mitigating factors for this vulnerability [2].

Exploitation and

Attack Surface

An attacker can exploit this vulnerability by providing specially crafted input to an application that uses the affected System.IO.Packaging library. No authentication is required, and the attack can be performed remotely if the application processes untrusted data. The vulnerability is present in .NET 6, .NET 8, and .NET 9 preview/RC versions, as well as corresponding Visual Studio installations [2][3].

Impact

Successful exploitation results in a denial of service, causing the affected application or service to become unresponsive or crash. This can disrupt availability for users relying on the software. The vulnerability does not lead to data compromise or privilege escalation; the impact is limited to availability [1].

Mitigation

Microsoft has released patches for the affected packages. Users should update System.IO.Packaging to the following patched versions: .NET 9: 9.0.0-rc.2.24473.5, .NET 8: 8.0.1, .NET 6: 6.0.1. Visual Studio users will be prompted to update via the IDE. No workarounds are available [2][4].

References
  1. NVD - CVE-2024-43484
  2. Microsoft Security Advisory CVE-2024-43484 | .NET Denial of Service Vulnerability
  3. Microsoft Security Advisory CVE-2024-43484 | .NET Denial of Service Vulnerability
  4. Microsoft Security Advisory CVE-2024-43484 | .NET Denial of Service Vulnerability

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
System.IO.PackagingNuGet
>= 9.0.0-preview.1.24080.9, < 9.0.0-rc.2.24473.59.0.0-rc.2.24473.5
System.IO.PackagingNuGet
>= 8.0.0-preview.1.23110.8, < 8.0.18.0.1
System.IO.PackagingNuGet
>= 6.0.0-preview.1.21102.12, < 6.0.16.0.1

Affected products

46

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.