A new remote code execution vulnerability has been identified to be affecting multiple Microsoft products including .NET, .NET Framework and Visual Studio.

This vulnerability has been assigned CVE-2024-21409, and its severity has been given as 7.3 (High).

This vulnerability is associated with the Use After Free condition, in which the pointer to a memory is not properly cleared and can be abused by another program.

However, Microsoft has released patches for addressing this vulnerability in the Patch Tuesday of April. 

Technical Analysis – CVE-2024-21409

According to the advisory, the vulnerable component affecting this vulnerability can be accessed locally, remotely, or via user interaction.

Microsoft also stated that no specific conditions are required to exploit this vulnerability. 

This means that any system running the mentioned Microsoft Products can be exploited.

Nevertheless, the attacker must have user privileges to exploit this vulnerability, as only a user can affect settings and files owned by a user. 

In case the threat actor has low privileges, the impact only applies to non-sensitive resources.

User interaction is required for successful exploitation, such as opening a malicious document sent through phishing mail or any social engineering attacks. 

Exploitation

To provide a brief explanation, a successful exploitation scenario starts with a threat actor gaining access to the system and running a specially crafted application to exploit this vulnerability and take control of the vulnerable system. 

To do this remotely, this specially crafted application can be sent as a link or malicious document to the user and trick them into downloading and executing the malicious application.

In this case, the vulnerability can be mentioned as an arbitrary code execution vulnerability.

When exploited, the threat actor can also temporarily or permanently deny access to the resource.

Furthermore, Microsoft has confirmed that there is no publicly available exploit for this vulnerability. 

Microsoft urges all of its users to upgrade to the latest versions and apply necessary patches to prevent the exploitation of this vulnerability by threat actors.

Secure your emails in a heartbeat! To find your ideal email security vendor, Take a Free 30-Second Assessment.