CVE-2022-24512: Microsoft .NET stack buffer overflow in Double Parse routine

Quick answers

Is CVE-2022-24512 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-24512 being exploited in the wild.

How severe is CVE-2022-24512?

Medium severity, with a CVSS score of 6.3, published 18 October 2022.

Which products and versions are affected?

Microsoft PowerShell 7.0 to 7.2.1; Microsoft Visual Studio 2019 16.0 to 16.11; Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm (NuGet) ECOSYSTEM:introduced=6.0.0,fixed=6.0.3; Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm64 (NuGet) ECOSYSTEM:introduced=6.0.0,fixed=6.0.3; and 113 more.

Is there a fix for CVE-2022-24512?

Yes. Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.browser-wasm (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-arm (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.browser-wasm (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-arm (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvos-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 3.1.23 or later; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 3.1.23 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 5.0.15 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 3.1.23 or later; Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 3.1.23 or later; Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 3.1.23 or later; Microsoft.NETCore.App.Runtime.Mono.android-arm (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.android-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.android-x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.android-x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.browser-wasm (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.ios-arm (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.ios-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.linux-arm (NuGet): upgrade to 5.0.15 or later; Microsoft.NETCore.App.Runtime.Mono.linux-arm64 (NuGet): upgrade to 5.0.15 or later; Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 (NuGet): upgrade to 5.0.15 or later; Microsoft.NETCore.App.Runtime.Mono.linux-x64 (NuGet): upgrade to 5.0.15 or later; Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64 (NuGet): upgrade to 5.0.15 or later; Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64 (NuGet): upgrade to 5.0.15 or later; Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64 (NuGet): upgrade to 5.0.15 or later; Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 (NuGet): upgrade to 5.0.15 or later; Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 (NuGet): upgrade to 5.0.15 or later; Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 (NuGet): upgrade to 5.0.15 or later; Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.osx-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.osx-x64 (NuGet): upgrade to 5.0.15 or later; Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.win-x64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NETCore.App.Runtime.Mono.win-x86 (NuGet): upgrade to 6.0.3 or later; Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 6.0.3 or later; Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 3.1.23 or later; Microsoft.NetCore.App.Runtime.win-arm (NuGet): upgrade to 3.1.23 or later; Microsoft.NetCore.App.Runtime.win-arm64 (NuGet): upgrade to 3.1.23 or later; Microsoft.NetCore.App.Runtime.win-x64 (NuGet): upgrade to 3.1.23 or later; Microsoft.NetCore.App.Runtime.win-x86 (NuGet): upgrade to 3.1.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-24512 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-24512?

Check whether you run Microsoft PowerShell, Microsoft Visual Studio 2019, Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

• Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.browser-wasm (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.browser-wasm --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-arm (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-arm --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.android-x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.browser-wasm (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.browser-wasm --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-arm (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-arm --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.ios-arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.iossimulator-x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.maccatalyst-x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvos-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvos-arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.osx-x64.Cross.tvossimulator-x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-arm64.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x64.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.android-x86.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm --version 6.0.3

• Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm.Msi.x64 --version 6.0.3

• Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 3.1.23 or later

  dotnet add package Microsoft.NetCore.App.Runtime.linux-arm --version 3.1.23

• Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 3.1.23 or later

  dotnet add package Microsoft.NetCore.App.Runtime.linux-arm64 --version 3.1.23

• Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 5.0.15 or later

  dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm --version 5.0.15

• Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 3.1.23 or later

  dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm64 --version 3.1.23

• Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 3.1.23 or later

  dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-x64 --version 3.1.23

• Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 3.1.23 or later

  dotnet add package Microsoft.NetCore.App.Runtime.linux-x64 --version 3.1.23

• Microsoft.NETCore.App.Runtime.Mono.android-arm (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-arm --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-arm.Msi.x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.android-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-arm64.Msi.x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.android-x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-x64.Msi.x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.android-x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.android-x86.Msi.x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.browser-wasm (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.browser-wasm --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.browser-wasm.Msi.x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.ios-arm (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.ios-arm --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.ios-arm.Msi.x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.ios-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.ios-arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.ios-arm64.Msi.x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64.Msi.x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.iossimulator-x86.Msi.x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.linux-arm (NuGet): upgrade to 5.0.15 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.linux-arm --version 5.0.15

• Microsoft.NETCore.App.Runtime.Mono.linux-arm64 (NuGet): upgrade to 5.0.15 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.linux-arm64 --version 5.0.15

• Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 (NuGet): upgrade to 5.0.15 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 --version 5.0.15

• Microsoft.NETCore.App.Runtime.Mono.linux-x64 (NuGet): upgrade to 5.0.15 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.linux-x64 --version 5.0.15

• Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64 (NuGet): upgrade to 5.0.15 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64 --version 5.0.15

• Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64 (NuGet): upgrade to 5.0.15 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64 --version 5.0.15

• Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64 (NuGet): upgrade to 5.0.15 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64 --version 5.0.15

• Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 (NuGet): upgrade to 5.0.15 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 --version 5.0.15

• Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 (NuGet): upgrade to 5.0.15 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 --version 5.0.15

• Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 (NuGet): upgrade to 5.0.15 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 --version 5.0.15

• Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64.Msi.x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64.Msi.x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.osx-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.osx-arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.osx-x64 (NuGet): upgrade to 5.0.15 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.osx-x64 --version 5.0.15

• Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.tvos-arm64.Msi.x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64.Msi.x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.arm64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64.Msi.x86 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.win-x64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.win-x64 --version 6.0.3

• Microsoft.NETCore.App.Runtime.Mono.win-x86 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NETCore.App.Runtime.Mono.win-x86 --version 6.0.3

• Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 6.0.3 or later

  dotnet add package Microsoft.NetCore.App.Runtime.osx-arm64 --version 6.0.3

• Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 3.1.23 or later

  dotnet add package Microsoft.NetCore.App.Runtime.osx-x64 --version 3.1.23

• Microsoft.NetCore.App.Runtime.win-arm (NuGet): upgrade to 3.1.23 or later

  dotnet add package Microsoft.NetCore.App.Runtime.win-arm --version 3.1.23

• Microsoft.NetCore.App.Runtime.win-arm64 (NuGet): upgrade to 3.1.23 or later

  dotnet add package Microsoft.NetCore.App.Runtime.win-arm64 --version 3.1.23

• Microsoft.NetCore.App.Runtime.win-x64 (NuGet): upgrade to 3.1.23 or later

  dotnet add package Microsoft.NetCore.App.Runtime.win-x64 --version 3.1.23

• Microsoft.NetCore.App.Runtime.win-x86 (NuGet): upgrade to 3.1.23 or later

  dotnet add package Microsoft.NetCore.App.Runtime.win-x86 --version 3.1.23

Technical details

A remote code execution (RCE) vulnerability exists in .NET 6.0, .NET 5.0, and .NET Core 3.1 due to a stack-based buffer overflow within the 'Double.Parse' routine. The flaw is triggered when the library processes specially crafted input strings representing floating-point numbers. An attacker can exploit this by providing malicious input to an application that parses user-supplied numerical data, potentially leading to arbitrary code execution in the context of the application. While the attack vector is network-based, it typically requires some form of user interaction or the processing of untrusted data (UI:R). Microsoft has released patches for the .NET Runtime, SDKs, and affected versions of Visual Studio and PowerShell to address this issue.

Affected products

• Microsoft .NET 6.0.0 to 6.0.2, 5.0.0 to 5.0.14, Core 3.1.0 to 3.1.22
• Microsoft Visual Studio 2019 16.0 to 16.11
• Microsoft PowerShell 7.0 to 7.2.1

Identifiers

• CVE-2022-24512
• GHSA-c6w8-7mp3-34j9

Timeline

• 2022-03-08: advisory: Initial Microsoft and GitHub advisory publication
• 2022-03-08: patched: Fixed versions released for .NET 6.0, 5.0, and 3.1

References

• https://github.com/dotnet/runtime/security/advisories/GHSA-c6w8-7mp3-34j9
• https://github.com/dotnet/announcements/issues/213
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-24512
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24512
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF