.NET and Visual Studio Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in .NET and Microsoft Visual Studio. This issue arises from a heap-based buffer overflow, which is triggered by an integer overflow in the 'msdia140.dll' file. The vulnerability affects multiple versions of the .NET runtime and several releases of Visual Studio. Exploitation requires convincing a user to open a maliciously crafted package file in Visual Studio.

Impact

Exploitation of this vulnerability allows for remote code execution.

Remediation

Users can upgrade to .NET Runtime versions 8.0.12 or 9.0.1. For Visual Studio, users should install the latest security update available for their version. Visual Studio 2015 Update 3 users can download the security update from the Microsoft Update Catalog.