CVE-2020-0605
published 2020-01-14CVE-2020-0605: A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully…
PriorityP357high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
17.77%
96.8th percentile
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0606.
Affected
104 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_net_framework_3.0 | — | — |
| microsoft | microsoft_net_framework_3.0 | — | — |
| microsoft | microsoft_net_framework_3.0 | — | — |
| microsoft | microsoft_net_framework_3.5 | — | — |
| microsoft | microsoft_net_framework_3.5 | — | — |
| microsoft | microsoft_net_framework_3.5 | — | — |
| microsoft | microsoft_net_framework_3.5 | — | — |
| microsoft | microsoft_net_framework_3.5 | — | — |
| microsoft | microsoft_net_framework_3.5 | — | — |
| microsoft | microsoft_net_framework_3.5 | — | — |
| microsoft | microsoft_net_framework_3.5.1 | — | — |
| microsoft | microsoft_net_framework_3.5.1 | — | — |
| microsoft | microsoft_net_framework_3.5.1 | — | — |
| microsoft | microsoft_net_framework_3.5.1 | — | — |
| microsoft | microsoft_net_framework_3.5.1 | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.6.2_4.7_4.7.1_4.7.2_on_windows_10_version_1607 | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.6.2_4.7_4.7.1_4.7.2_on_windows_server_2016 | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.1_4.7.2_on_windows_10_version_1709_for_32-bi | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.1_4.7.2_on_windows_10_version_1709_for_x64-b | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.2_on_windows_10_for_32-bit_systems | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.2_on_windows_10_for_x64-based_systems | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.2_on_windows_10_version_1803_for_32-bit_syst | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.2_on_windows_10_version_1803_for_x64-based_s | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.2_on_windows_10_version_1809_for_32-bit_syst | — | — |
| microsoft | microsoft_net_framework_3.5_and_4.7.2_on_windows_10_version_1809_for_x64-based_s | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability is triggered when a user opens a specially crafted file that bypasses WPF XAML source markup validation in .NET Framework; monitor for unexpected XAML file opens or WPF application crashes. ↗
- →The attack vector includes email delivery of a malicious file; monitor for email attachments opened by .NET/WPF applications, particularly XAML-related file types. ↗
- →Red Hat describes this as a 'Bypass of WPF XAML payload prevention', indicating the crafted file likely contains a XAML payload; consider alerting on XAML files delivered via email or downloaded from the internet being opened by WPF processes. ↗
- ·No public exploit exists at time of advisory; Microsoft assessed exploitation as 'Less Likely' for both latest and older software releases. ↗
- ·Red Hat .NET Core packages (2.1, 2.2, 3.0, 3.1) and RHEL 8 dotnet packages are all confirmed not affected; the vulnerable components are Windows-specific WPF/.NET Framework components not shipped by Red Hat. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
ghsa8.8HIGH
osv8.8HIGH
vendor_msrc8.8CRITICAL
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
.NET Framework Remote Code Execution Vulnerability
vendor_msrc·2020-01-14·CVSS 8.8
CVE-2020-0605 [HIGH] .NET Framework Remote Code Execution Vulnerability
.NET Framework Remote Code Execution Vulnerability
Description: A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.
An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Exploitation of the vulnerability requires that a user open a specially crafted file with an affecte
Red Hat
dotnet: Bypass of WPF XAML payload prevention
vendor_redhat·2020-01-14·CVSS 8.8
CVE-2020-0605 [HIGH] CWE-20 dotnet: Bypass of WPF XAML payload prevention
dotnet: Bypass of WPF XAML payload prevention
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0606.
A vulnerability related to checking the source makeup of a file has been reported in .NET software. A remote attacker can exploit this vulnerability to execute arbitrary code by tricking a user into opening a specially crafted file.
Statement: The affected components are not shipped by Red Hat.
Package: rh-dotnet21 (.NET Core 2.1 on Red Hat Enterprise Linux) - Not affected
Package: rh-dotnet22 (.NET Core
Red Hat
dotnet: Malfunctioning StickyNotes annotation XML files malicious execution prevetion
vendor_redhat·2020-01-14·CVSS 8.8
CVE-2020-0606 [HIGH] CWE-20 dotnet: Malfunctioning StickyNotes annotation XML files malicious execution prevetion
dotnet: Malfunctioning StickyNotes annotation XML files malicious execution prevetion
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0605.
A vulnerability related to checking the source makeup of a file has been reported in .NET software. A remote attacker can exploit this vulnerability to execute arbitrary code by tricking a user into opening a specially crafted file.
Statement: The affected components are not shipped by Red Hat.
Package: rh-dotnet21 (.NET Core 2.1 on Red Hat Enterprise Linux) - Not af
OSV
PowerShell is subject to remote code execution vulnerability
osv·2024-02-02·CVSS 8.8
CVE-2020-0605 [HIGH] PowerShell is subject to remote code execution vulnerability
PowerShell is subject to remote code execution vulnerability
# Microsoft Security Advisory CVE-2020-0605: .NET Framework Remote Code Execution Vulnerability
## Executive Summary
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.
An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrat
GHSA
PowerShell is subject to remote code execution vulnerability
ghsa·2024-02-02·CVSS 8.8
CVE-2020-0605 [HIGH] PowerShell is subject to remote code execution vulnerability
PowerShell is subject to remote code execution vulnerability
# Microsoft Security Advisory CVE-2020-0605: .NET Framework Remote Code Execution Vulnerability
## Executive Summary
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.
An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrat
GHSA
Remote code execution in Microsoft.WindowsDesktop.App.Ref
ghsa·2022-05-24·CVSS 8.8
CVE-2020-0606 [HIGH] CWE-20 Remote code execution in Microsoft.WindowsDesktop.App.Ref
Remote code execution in Microsoft.WindowsDesktop.App.Ref
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0605.
OSV
Remote code execution in Microsoft.WindowsDesktop.App.Ref
osv·2022-05-24·CVSS 8.8
CVE-2020-0606 [HIGH] Remote code execution in Microsoft.WindowsDesktop.App.Ref
Remote code execution in Microsoft.WindowsDesktop.App.Ref
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0605.
GHSA
GHSA-f3wx-45hf-3hwx: A remote code execution vulnerability exists in
ghsa_unreviewed·2022-05-24·CVSS 8.8
CVE-2020-0605 [HIGH] GHSA-f3wx-45hf-3hwx: A remote code execution vulnerability exists in
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0606.
No detection rules found.
No public exploits indexed.
Talos
Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage
blogs_talos·2020-01-14·CVSS 8.1
CVE-2020-0601 [HIGH] Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage
## Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage
By Jon Munshaw. Updated January 15th: Added an Advanced Custom Detection (ACD) signature for AMP that can be used to detect exploitation of CVE-2020-0601 by spoofing certificates masquerading as a Microsoft ECC Code Signing Certificate Authority.
Microsoft released its monthly security update today, disclosing vulnerabilities across many of its products and releasing corresponding updates. This month's Patch Tuesday covers 49 vulnerabilities, eight of which are considered critical.
This month's security update is particularly important for its disclosure of two vulnerabilities related to a core cryptographic component in all versions of Windows. CVE-2020-0601 could allow an attacker to use cryptography
Tenable
Microsoft’s January 2020 Patch Tuesday Kicks Off the New Year with 49 New CVEs
blogs_tenable·2020-01-14
Microsoft’s January 2020 Patch Tuesday Kicks Off the New Year with 49 New CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage
blogs_talos·2020-01-14·CVSS 8.1
CVE-2020-0601 [HIGH] Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage
By Jon Munshaw.
Updated January 15th: Added an Advanced Custom Detection (ACD) signature for AMP that can be used to detect exploitation of CVE-2020-0601 by spoofing certificates masquerading as a Microsoft ECC Code Signing Certificate Authority.
Microsoft released its monthly security update today, disclosing vulnerabilities across many of its products and releasing corresponding updates. This month's Patch Tuesday covers 49 vulnerabilities, eight of which are considered critical.
This month's security update is particularly important for its disclosure of two vulnerabilities related to a core cryptographic component in all versions of Windows. CVE-2020-0601 could allow an attacker to use cryptography to sign a malicious executable, making the file appear as if it was from a trusted sou
Crowdstrike
Vulnerability Roundup: 10 Critical CVEs of 2020
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] Vulnerability Roundup: 10 Critical CVEs of 2020
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Bugzilla
CVE-2020-0605 dotnet: Bypass of WPF XAML payload prevention
bugzilla·2020-01-09·CVSS 8.8
CVE-2020-0605 [HIGH] CVE-2020-0605 dotnet: Bypass of WPF XAML payload prevention
CVE-2020-0605 dotnet: Bypass of WPF XAML payload prevention
A vulnerability related to checking the source makeup of a file has been reported in .NET software. A remote attacker can exploit this vulnerability to execute arbitrary code by tricking a user into opening a specially crafted file.
Discussion:
External References:
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0605
https://github.com/dotnet/announcements/issues/148
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2020-0605
---
Statement:
The affected components are not shipped by Red Hat.
2020-01-14
Published