What is CVE-2023-36794?

CVE-2023-36794 is a high-severity remote code execution vulnerability affecting Microsoft Visual Studio, .NET Framework, and PowerShell on various Windows operating systems, including Windows Server and Windows 10 and 11. To exploit this vulnerability, an attacker would need to convince a user to open a maliciously crafted package file in Visual Studio. It is crucial for organizations to be aware of this vulnerability and take appropriate measures to protect their systems.

Who is impacted by CVE-2023-36794?

The CVE-2023-36794 vulnerability affects users of Microsoft Visual Studio, .NET Framework, and PowerShell on various Windows operating systems, including Windows Server and Windows 10 and 11. Affected versions include Microsoft Visual Studio 2017 (versions 15.0 to 15.9.57), 2019 (versions 16.0 to 16.11.30), and 2022 (versions 17.2 to 17.2.19, 17.4 to 17.4.11, and 17.7 to 17.7.4), as well as .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, 4.8.1, 6.0.0, and 7.0.0. It is important for organizations to be aware of this vulnerability and take appropriate measures to protect their systems.

What to do if CVE-2023-36794 affected you

If you're affected by the CVE-2023-36794 vulnerability, it's important to take action to protect your systems. Follow these simple steps:

1. Install security updates provided by Microsoft for affected products.

2. Keep software up-to-date and apply patches as they become available.

3. Monitor the Microsoft Security Response Center for updates or additional information related to this vulnerability.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-36794 vulnerability, also known as Visual Studio Remote Code Execution Vulnerability, is not listed in CISA's Known Exploited Vulnerabilities Catalog. It was published on September 12, 2023. To address this vulnerability, users should install security updates provided by Microsoft. In simple terms, this vulnerability allows an attacker to execute code on a target system by tricking a user into opening a malicious file in Visual Studio, potentially compromising the system's security.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-191, an integer underflow issue affecting Microsoft Visual Studio.

Learn More

For a comprehensive understanding of its description, severity, technical details, and affected software configurations, refer to the NVD page.

• Microsoft Security Update Guide

• CVE Record