Vulnerability & Exploit Database

Back to search

Microsoft CVE-2018-8540: .NET Framework Remote Code Injection Vulnerability

Severity CVSS Published Added Modified
10 (AV:N/AC:L/Au:N/C:C/I:C/A:C) December 11, 2018 December 11, 2018 February 12, 2019


A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. To exploit the vulnerability, an attacker would need to pass specific input to an application utilizing susceptible .Net methods. The security update addresses the vulnerability by correcting how the Microsoft .NET Framework validates input.

Scan For This Vulnerability

Use our top-rated tool to discover, prioritize, and remediate your vulnerabilities

 Free InsightVM Trial


Solution Reference

Microsoft Security Update Guide