CVE-2023-29331

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

HIGH

7.5

CVSS Score

Published: June 14, 2023 at 02:52 PM UTC

Updated: June 17, 2026 at 05:49 AM UTC

17 products affected across 1 vendor.NET FrameworkVisual Studio 2022.net

Using .NET 6.0 by Microsoft?

Get instant alerts when new vulnerabilities affect .NET 6.0 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 3%

SSVC

No known exploit

Description

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

.net · Microsoft

95%

2.0.0 ≤ v < 3.0.6920.8954; 2.0.50727.89703.0.0 ≤ v < 3.0.6920.8954; 2.0.50727.89703.5.0 ≤ v < 3.0.6920.8954; 2.0.50727.89704.7.0 ≤ v < 10.0.10240.199834.7.0 ≤ v < 4.7.04043.04.7.0 ≤ v < 4.7.4050.04.8.0 ≤ v < 4.8.4644.04.8.1 ≤ v < 4.8.9166.06.0.0 ≤ v < 6.0.187.0.0 ≤ v < 7.0.76.0.0 7.0.0

Affected range stops below 10.0.10240.19983, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.0.6920.8954; 2.0.50727.8970, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.7.04043.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.7.4050.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.8.4644.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.8.9166.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.0.18, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.0.7, so it looks safe — our inference, not a vendor statement

.NET Framework · Microsoft

95%

2.0.0 ≤ v < 3.0.6920.8954; 2.0.50727.89703.0.0 ≤ v < 3.0.6920.8954; 2.0.50727.89703.0.0.0 ≤ v < 10.0.14393.59893.5.0 ≤ v < 3.0.6920.8954; 2.0.50727.89704.7.0 ≤ v < 10.0.10240.199834.7.0 ≤ v < 4.7.04043.04.7.0 ≤ v < 4.7.4050.04.8.0 ≤ v < 4.8.4644.04.8.1 ≤ v < 4.8.9166.02.0 sp2 2.0.0 3.0 sp2 3.0.0 3.0.0.0 3.5 3.5.0 3.5.1 4.6.2 4.7 4.7.0 4.7.1 4.7.2 4.8 4.8.0 4.8.1

Affected range stops below 10.0.10240.19983, so it looks safe — our inference, not a vendor statement

Affected range stops below 10.0.14393.5989, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.0.6920.8954; 2.0.50727.8970, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.7.04043.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.7.4050.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.8.4644.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.8.9166.0, so it looks safe — our inference, not a vendor statement

microsoft-windows-10-1507 (environment) · microsoft-windows-10-1607 (environment) · microsoft-windows-10-1809 (environment) · microsoft-windows-10-21h2 (environment) · microsoft-windows-10-22h2 (environment) · microsoft-windows-11-21h2 (environment) · microsoft-windows-11-22h2 (environment) · microsoft-windows-server-2008 (environment) · microsoft-windows-server-2012 (environment) · microsoft-windows-server-2016 (environment) · microsoft-windows-server-2019 (environment) · microsoft-windows-server-2022 (environment)

PowerShell · Microsoft

95%

7.2.0 ≤ v < 7.2.127.3.0 ≤ v < 7.3.57.2.0 7.3.0

Affected range stops below 7.2.12, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.3.5, so it looks safe — our inference, not a vendor statement

Visual Studio · Microsoft

95%

17.6.0 ≤ v < 17.6.3

Affected range stops below 17.6.3, so it looks safe — our inference, not a vendor statement

Visual Studio 2022 · Microsoft

95%

17.0.0 ≤ v < 17.0.2217.2.0 ≤ v < 17.2.1617.4.0 ≤ v < 17.4.817.6.0 ≤ v < 17.6.317.0.0 17.2.0 17.4.0 17.6.0

Affected range stops below 17.0.22, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.2.16, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.4.8, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.6.3, so it looks safe — our inference, not a vendor statement

Windows 10 1507 · Microsoftdevice

80%

All versions

Windows 10 1607 · Microsoftdevice

80%

All versions

Windows 10 1809 · Microsoftdevice

80%

All versions

Windows 10 21H2 · Microsoftdevice

80%

All versions

Windows 10 22H2 · Microsoftdevice

80%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29331

References (1)

Vendor AdvisoryPatch

Source: [email protected]

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29331

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHmicrosoft

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-400NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card