Remote code execution in Microsoft .NET

Published: 2023-04-11 | Updated: 2023-04-18
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2023-28260
Exploitation vector Network
Public exploit N/A
Vulnerable software
Visual Studio
Universal components / Libraries / Software for developers

Client/Desktop applications / Software for system administration

Other software / Other software solutions

Vendor Microsoft

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Insecure DLL loading

EUVDB-ID: #VU74917

Risk: Medium


CVE-ID: CVE-2023-28260


Exploit availability:


The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to the application loads DLL libraries in an insecure manner. A remote attacker can place a specially crafted .dll file on a remote SMB fileshare, trick the victim into opening a file, associated with the vulnerable application, and execute arbitrary code on victim's system.


Install updates from vendor's website.

Vulnerable software versions

Visual Studio: 17.0.0 17.0.31903.59 - 17.5.0 17.5.33414.496

PowerShell: 7.2.0 - 7.3.3

.NET: 6.0.1 - 7.0.4

Fixed software versions

CPE2.3 External links

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?