VYPR
← All advisories
High severityNVD Advisory· Published Nov 12, 2024· Updated Aug 27, 2025

.NET and Visual Studio Denial of Service Vulnerability

CVE-2024-43499

Description

.NET and Visual Studio Denial of Service Vulnerability

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Incorrect input validation in .NET's NrbfDecoder component leads to a denial of service vulnerability, affecting applications using the System.Formats.Nrbf package.

The vulnerability exists in the NrbfDecoder component within the System.Formats.Nrbf package of .NET 9.0. Due to improper input validation, an attacker can cause a denial of service by providing specially crafted input to the decoder [1].

Attack

Vector Applications that explicitly use the NrbfDecoder are vulnerable. Default .NET console and web apps do not reference this component, limiting the attack surface. The attacker must supply malformed data to the NrbfDecoder, which could occur if the application processes untrusted binary data [1].

Impact

Successful exploitation results in a denial of service, potentially crashing the application or making it unresponsive [1].

Mitigation

Microsoft has released version 9.0.0 of the System.Formats.Nrbf package, which fixes the vulnerability. Developers should update their .NET SDK and package references to the patched version [1].

References
  1. Microsoft Security Advisory CVE-2024-43499 | .NET Denial of Service Vulnerability

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
System.Formats.NrbfNuGet
< 9.0.09.0.0

Affected products

49

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.