CVE-2021-24112 .NET Core Remote Code Execution Vulnerability

High 8.1 Published 25 Feb 2021 Updated 7 Oct 2026

Attackers can execute arbitrary code via code injection in the .NET Core runtime, affecting developers and applications using affected versions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-24112?

CVE-2021-24112 is a high-severity code injection vulnerability in Microsoft .Net, published on 25 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

.NET Core Remote Code Execution Vulnerability

Weakness: CWE-94

Which versions are affected by CVE-2021-24112?

6 open source packages ship an affected version, including System.Drawing.Common, dotnet and dotnet-sdk. It affects 4 products.

Package	Affected	Fixed in
`System.Drawing.Common` NuGet	From `4.0.0`	`4.7.2`
`System.Drawing.Common` NuGet	From `4.0.0`	`4.7.2`
`System.Drawing.Common` NuGet	From `5.0.0`	`5.0.3`
`System.Drawing.Common` NuGet	From `5.0.0`	`5.0.3`
`dotnet` Bitnami	From `5.0.0`	`5.0.3`
`dotnet-sdk` Bitnami	From `5.0.0`	`5.0.3`

Products include Microsoft .Net, Microsoft .Net Core, Microsoft Mono, Microsoft Visual Studio 2019.

How do I fix CVE-2021-24112?

Upgrade System.Drawing.Common to a fixed version for your release line: 4.7.2 or 5.0.3.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-24112 being exploited?

There is no known exploitation of CVE-2021-24112 in the wild and no public exploit code.

All Microsoft .Net vulnerabilities

Sources

Also known as BIT-dotnet-2021-24112, BIT-dotnet-sdk-2021-24112, GHSA-rxg9-xrhp-64gj, openSUSE-SU-2024:11556-1.