cbcvebase.
CVE-2012-0163
published 2012-04-10

CVE-2012-0163: Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate function parameters, which allows remote attackers to…

PriorityP266critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
38.25%
98.4th percentile
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate function parameters, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework Parameter Validation Vulnerability."

Affected

7 ranges
VendorProductVersion rangeFixed in
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——

Detection & IOCsextracted from sources · hover to see the quote

otherEncoderParameter(Encoder, Int32[], Int32[], Int32[], Int32[])↗
filenameSystem.Drawing.dll↗
other0x10000000 (268,435,456 array members)↗
  • →Monitor for .NET applications allocating extremely large integer arrays (268,435,456+ members) passed to EncoderParameter constructors, which triggers the integer overflow heap allocation of 0 bytes. ↗
  • →Look for access violations (exit code 0xc0000005) originating from managed .NET processes loading System.Drawing.dll from the GAC, which may indicate heap corruption via EncoderParameter overflow. ↗
  • →The missing array-length validation check (numerator2 not validated against denominator2) allows controlled heap writes; monitor for IndexOutOfRangeException caught within EncoderParameter constructor calls in sandboxed .NET contexts. ↗
  • ·SilverLight applications cannot exploit this vulnerability as the affected EncoderParameter class is not available in that runtime. ↗
  • ·Exploitation on Windows XP is unreliable due to OutOfMemoryException when handling large arrays; successful exploitation required a 32-bit XP system with 4GB RAM. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.