CVE-2023-33126: Microsoft.NETCore.App.Runtime.win-arm64 fixed in 7.0.5 and 6.0.16

CVE-2023-33126 PUBLISHED CVSS 7.3 HIGH

.NET and Visual Studio Remote Code Execution Vulnerability

Reported by microsoft · Published June 13, 2023

Microsoft.NETCore.App.Runtime.win-arm64 is fixed in 7.0.5 and 6.0.16 (NuGet)

.NET and Visual Studio Remote Code Execution Vulnerability

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
Microsoft.NETCore.App.Runtime.win-arm64	NuGet	7.0.5, 6.0.16
Microsoft.NetCore.App.Runtime.win-arm	NuGet	7.0.7, 7.0.5, 6.0.18, 6.0.16
Microsoft.NetCore.App.Runtime.win-x64	NuGet	7.0.7, 7.0.5, 6.0.18, 6.0.16
Microsoft.NETCore.App.Runtime.win-x86	NuGet	7.0.5, 6.0.16
dotnet	Bitnami	7.0.7, 6.0.18
dotnet6-runtime	Alpine	6.0.18-r0
dotnet6-build	Alpine	6.0.118-r0
dotnet7-build	Alpine	7.0.107-r0
Microsoft Visual Studio 2022 version 17.2	Microsoft	17.2.16
visual_studio_2022	microsoft	17.6.3, 17.4.8, 17.2.16, 17.0.22
PowerShell 7.2	Microsoft	7.2.12
Microsoft Visual Studio 2022 version 17.4	Microsoft	17.4.8

CVSS 3.1

7.3

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Vendor	Product	Versions
Microsoft	.NET 6.0	6.0.0
Microsoft	.NET 7.0	7.0.0
Microsoft	Microsoft Visual Studio 2022 version 17.2	17.2.0
Microsoft	Microsoft Visual Studio 2022 version 17.0	17.0.0
Microsoft	Microsoft Visual Studio 2022 version 17.4	17.4.0
Microsoft	Microsoft Visual Studio 2022 version 17.6	17.6.0
Microsoft	PowerShell 7.2	7.2.0
Microsoft	Microsoft Visual Studio 2022 version 17.2	17.2.0
NuGet	Microsoft.NETCore.App.Runtime.win-arm64	7.0.0, 6.0.0
alpine	dotnet6-runtime	0
Microsoft	PowerShell 7.2	7.2.0
NuGet	Microsoft.NETCore.App.Runtime.win-arm	7.0.0, 6.0.0
alpine	dotnet6-build	0
Microsoft	Microsoft Visual Studio 2022 version 17.4	17.4.0
alpine	dotnet7-build	0
NuGet	Microsoft.NETCore.App.Runtime.win-x64	7.0.0, 6.0.0
NuGet	Microsoft.NETCore.App.Runtime.win-x86	6.0.0, 7.0.0
microsoft	visual_studio_2022	17.4.0, 17.2.0, 17.0.0
microsoft	.net	7.0.0, 6.0.0
microsoft	visual_studio	17.6.0

…and 6 more

The same record, from the CLI:

vulnetix vdb vuln CVE-2023-33126
vulnetix vdb fixes CVE-2023-33126

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-33126/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart