CVE-2023-36793: Microsoft .NET Framework RCE Vulnerability

CVE-2023-36793 Overview

CVE-2023-36793 is a remote code execution vulnerability affecting Microsoft Visual Studio 2017, 2019, and 2022, along with Microsoft .NET Framework and .NET 6.0/7.0 runtimes. Microsoft assigned the issue a CVSS 3.1 base score of 7.8 and categorized it under CWE-122: Heap-based Buffer Overflow. Successful exploitation requires a victim to open a crafted package or project file, granting an attacker code execution in the context of the current user. Microsoft published the advisory on September 12, 2023 as part of the monthly security update cycle.

Critical Impact
An attacker who successfully exploits CVE-2023-36793 can execute arbitrary code in the context of the user opening a malicious file, leading to full compromise of confidentiality, integrity, and availability on the affected workstation.

Affected Products

Microsoft Visual Studio 2017, 2019, and 2022
Microsoft .NET 6.0 and .NET 7.0
Microsoft .NET Framework (2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, 4.8.1) on supported Windows 10/11 and Windows Server 2008–2022 platforms

Discovery Timeline

2023-09-12 - CVE-2023-36793 published to NVD and Microsoft releases security update
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36793

Vulnerability Analysis

CVE-2023-36793 is a heap-based buffer overflow (CWE-122) in the package and project parsing components shared by Visual Studio, .NET, and the .NET Framework. The flaw allows a local, unauthenticated attacker to obtain code execution when a user opens a malicious file in Visual Studio or a process that loads the affected .NET runtime parsers. Because exploitation requires user interaction, attackers typically deliver weaponized solution files, NuGet packages, or project assets through phishing or supply chain channels. Once triggered, the overflow corrupts heap metadata or adjacent objects to redirect execution flow inside the developer's process.

Root Cause

The vulnerability stems from insufficient bounds checking when parsing structured input fields within Visual Studio and .NET package or project handling code. A crafted file supplies length or offset values that exceed the allocated heap buffer. The parser writes attacker-controlled data past the buffer boundary, corrupting heap-managed structures used by the runtime.

Attack Vector

The attack vector is local with required user interaction. An attacker crafts a malicious Visual Studio project, solution, or package file and convinces a developer to open it. When the IDE or .NET tooling parses the file, the heap overflow triggers and yields code execution at the developer's privilege level. Refer to the Microsoft Security Update Guide entry for CVE-2023-36793 for full vendor details. No public proof-of-concept exploit is available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2023-36793

Indicators of Compromise

Unexpected child processes spawned by devenv.exe, MSBuild.exe, or dotnet.exe (for example, cmd.exe, powershell.exe, or rundll32.exe).
Visual Studio process crashes with heap corruption exceptions immediately after opening a project, solution, or NuGet package from an untrusted source.
New persistence artifacts (scheduled tasks, Run keys, or service entries) created shortly after a developer opens an externally sourced .sln, .csproj, or .nupkg file.

Detection Strategies

Hunt for command-line patterns where Visual Studio or the .NET host launches script interpreters or LOLBins not associated with normal build activity.
Correlate file open events for .sln, .csproj, .vcxproj, and .nupkg files from email attachments or download folders with subsequent suspicious process trees.
Monitor for Windows Error Reporting events tied to devenv.exe or dotnet.exe faulting modules, which can indicate exploitation attempts.

Monitoring Recommendations

Enable Microsoft Defender for Endpoint or equivalent EDR telemetry on all developer workstations and ingest process-creation, image-load, and file-write events into a central SIEM.
Alert on installations of unsigned or untrusted NuGet packages and on project files originating from outside approved source control systems.
Track Visual Studio and .NET runtime version inventory to confirm that the September 2023 patches are deployed across all developer endpoints.

How to Mitigate CVE-2023-36793

Immediate Actions Required

Apply the September 2023 Microsoft security updates for Visual Studio 2017, 2019, and 2022 and for the affected .NET Framework and .NET 6.0/7.0 runtimes.
Inventory developer endpoints and CI/CD build agents to confirm all instances of Visual Studio and the .NET runtimes are patched.
Restrict opening of project, solution, and package files originating from untrusted email attachments, file shares, or websites.

Patch Information

Microsoft released fixes for CVE-2023-36793 on September 12, 2023. Administrators should apply the cumulative updates listed in the Microsoft Security Update Guide for CVE-2023-36793, which include updated installers for Visual Studio 2017 (15.9.x), Visual Studio 2019 (16.11.x), Visual Studio 2022 (17.2.x, 17.4.x, 17.6.x), .NET 6.0, .NET 7.0, and the supported .NET Framework versions on Windows 10, Windows 11, and Windows Server 2008 through 2022.

Workarounds

Treat untrusted .sln, .csproj, .vcxproj, and .nupkg files as malicious and open them only inside isolated virtual machines or sandboxed developer environments.
Enforce package source allow-listing in NuGet configuration so developers can only restore packages from approved internal feeds.
Run Visual Studio under standard (non-administrative) user accounts to limit the impact of successful exploitation.

bash

# Verify installed Visual Studio version and patch level on a developer workstation
"%ProgramFiles(x86)%\Microsoft Visual Studio\Installer\vswhere.exe" -all -property displayName -property installationVersion

# List installed .NET runtimes to confirm patched versions are present
dotnet --list-runtimes

# Restrict NuGet to an approved internal feed only
nuget sources Disable -Name "nuget.org"
nuget sources Add -Name "InternalFeed" -Source "https://nuget.internal.example.com/v3/index.json"