.Net Framework
Vendor:
First CVE: Jul 26, 2002 · Active for 23 years
200
Total CVEs
More Total CVEs than 99% of tracked products
8.3
Avg CVEs / Year
Higher CVE frequency than 94% of tracked products
7.6
Avg CVSS
Higher Avg CVSS than 60% of tracked products
2.5%
KEV Rate
Higher KEV Rate than 96% of tracked products
Trends Over Time
The number and severity of CVEs published that impact .Net Framework over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jul 26, 2002
23 years ago
Most Recent CVE
Jul 14, 2026
11 days ago
CVE Severity & Scoring
.Net Framework200 CVEs
22%
74%
All CVEs352,708 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local37 (18.5%)
Network69 (34.5%)
Unknown93 (46.5%)
Physical0 (0.0%)
Adjacent Network1 (0.5%)
Attack Complexity
Low97 (48.5%)
High10 (5.0%)
Unknown93 (46.5%)
User Interaction
None70 (35.0%)
Unknown93 (46.5%)
Required37 (18.5%)
Privileges Required
Low19 (9.5%)
High0 (0.0%)
None88 (44.0%)
Unknown93 (46.5%)
Top CVEs
Signals from CVEs in this product scope (200 CVEs).
200 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-0646CRITICAL A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'. | Jan 14, 2020 | 9.8 | 99 | YES | YES |
CVE-2020-1147HIGH A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '. | Jul 14, 2020 | 7.8 | 98 | YES | YES |
CVE-2024-29059HIGH .NET Framework Information Disclosure Vulnerability | Mar 23, 2024 | 7.5 | 97 | YES | YES |
CVE-2017-8759HIGH Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework R | Sep 13, 2017 | 7.8 | 96 | YES | YES |
CVE-2015-1671HIGH The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 20 | May 13, 2015 | 7.8 | 85 | YES | NO |
CVE-2014-0257HIGH Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers | Feb 12, 2014 | 9.3 | 78 | NO | YES |
CVE-2007-0042HIGH Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access configuration files | Jul 10, 2007 | 7.8 | 74 | NO | YES |
CVE-2023-36899HIGH ASP.NET Elevation of Privilege Vulnerability | Aug 8, 2023 | 8.8 | 71 | NO | NO |
CVE-2010-3332MEDIUM Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes | Sep 22, 2010 | 6.4 | 69 | NO | YES |
CVE-2004-0200HIGH Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via | Sep 28, 2004 | 9.3 | 68 | NO | YES |
Exploit Exposure
Signals from CVEs in this product scope (200 CVEs).
CISA KEV
5 CVEs
2.5% of CVEs· 96th percentile
Metasploit
3 CVEs
1.5% of CVEs· 96th percentile
Nuclei
2 CVEs
1.0% of CVEs· 96th percentile
ExploitDB
21 CVEs
10.5% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (200 CVEs).
Media Mentions
Signals from CVEs in this product scope (200 CVEs).
Top CNAs Publishing CVEs For .Net Framework
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 4.8.1 | 50 | 7.5 | 4.0% | 1 | 1 |
| 4.8 | 67 | 7.2 | 6.8% | 3 | 3 |
| 4.7.2 | 82 | 7.5 | 10.0% | 3 | 3 |
| 4.7.1 | 80 | 7.5 | 10.6% | 3 | 3 |
| 4.7 | 84 | 7.5 | 10.9% | 4 | 5 |
| 4.6.2 | 85 | 7.5 | 11.0% | 4 | 5 |
| 4.6.1 | 45 | 7.4 | 14.2% | 3 | 4 |
| 4.6 | 65 | 7.5 | 16.8% | 4 | 12 |
| 4.5.2 | 61 | 7.6 | 19.7% | 4 | 11 |
| 4.5.1 | 24 | 7.7 | 33.1% | 1 | 8 |
| 4.5 | 44 | 8.0 | 30.6% | 1 | 9 |
| 4.0 | 58 | 8.1 | 29.5% | 1 | 11 |
| 3.5.1 | 122 | 7.7 | 21.1% | 5 | 18 |
| 3.5 | 147 | 7.7 | 13.6% | 5 | 18 |
| 3.0 | 68 | 7.8 | 18.1% | 4 | 11 |
| 2.0.50727 | 1 | 10.0 | 8.4% | 0 | 0 |
| 2.0 | 121 | 8.0 | 21.6% | 3 | 10 |
| 1.1 | 38 | 7.9 | 27.9% | 0 | 7 |
| 1.0 | 26 | 6.8 | 21.5% | 0 | 5 |