CVE-2020-0606 Remote code execution in Microsoft.WindowsDesktop.App.Ref

What is CVE-2020-0606?

CVE-2020-0606 is a high-severity code injection vulnerability in Microsoft .Net Framework, published on 14 Jan 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0605.

Weakness: CWE-20

Which versions are affected by CVE-2020-0606?

12 open source packages ship an affected version, including Microsoft.WindowsDesktop.App.Ref, Microsoft.WindowsDesktop.App.Runtime.win-x64 and Microsoft.WindowsDesktop.App.Runtime.win-x86. It affects 2 products.

Products include Microsoft .Net Core, Microsoft .Net Framework.

How do I fix CVE-2020-0606?

Upgrade Microsoft.WindowsDesktop.App.Ref to a fixed version for your release line: 3.0.2 or 3.1.1.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2020-0606 being exploited?

There is no known exploitation of CVE-2020-0606 in the wild and no public exploit code.

Other vulnerabilities in Microsoft .Net Framework

• CVE-2020-1147 Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Exploited High 7.8
• CVE-2020-0605 Code injection in .NET Core High 8.8
• CVE-2019-1301 High severity vulnerability that affects System.Management.Automation High 7.5
• CVE-2019-0820 Regular Expression Denial of Service in System.Text.RegularExpressions High 7.5
• CVE-2019-0980 Denial of service in ASP.NET Core High 7.5

All Microsoft .Net Framework vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r4mw-gxf7-vxr9.