← Vulnerability feed

Vulnerability record · CVE-2012-0014 · published 14 February 2012

CVE-2012-0014: Microsoft .net framework code injection vulnerability

Microsoft · .Net Framework

Microsoft .NET Framework 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.1.10111, does not properly restrict access to memory associated with unmanaged objects, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, (3) a crafted .NET Framework application, or (4) a crafted Silverlight application, aka ".NET Framework Unmanaged Objects Vulnerability."

7.8 CVSS 3.1 High EPSS 28% · top 1.9% CWE-94 · Code injection
7.8CVSS 3.1 base score, v2 9.3
28%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
6References
16 Jun 2026Last modified by NVD

Description

Microsoft .NET Framework 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.1.10111, does not properly restrict access to memory associated with unmanaged objects, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, (3) a crafted .NET Framework application, or (4) a crafted Silverlight application, aka ".NET Framework Unmanaged Objects Vulnerability."

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.us-cert.gov/cas/techalerts/TA12-045A.html Third Party AdvisoryUS Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-016
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13972
http://www.us-cert.gov/cas/techalerts/TA12-045A.html Third Party AdvisoryUS Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-016
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13972

Track CVE-2012-0014 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-0646Microsoft .NET Framework input validation flaw enables remote code executionCVE-2020-0646 is a critical remote code execution vulnerability in the Microsoft .NET Framework caused by improper input validation, classified as XM…KEVEPSS 99%analysed8.8CVE-2016-0034Microsoft Silverlight negative offset decoding flaw allows remote code executionMicrosoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, corrupting object headers. A remote attacker can exploit this…KEVEPSS 69%analysed7.8CVE-2020-1147Microsoft .NET Framework, SharePoint, and Visual Studio XML Deserialization RCEThe software fails to check the source markup of XML input, allowing crafted XML to trigger unsafe deserialization and remote code execution. It affe…KEVEPSS 94%analysed7.8CVE-2017-8759Microsoft .NET Framework remote code execution via malicious documentMicrosoft .NET Framework versions 2.0 through 4.7 contain a code injection flaw that lets an attacker run arbitrary code when a crafted document or a…KEVEPSS 89%analysed7.8CVE-2015-1671Microsoft DirectWrite TrueType Font Parsing Remote Code ExecutionThe Windows DirectWrite library fails to properly handle crafted TrueType fonts, allowing memory corruption that can lead to arbitrary code execution…KEVEPSS 49%analysed7.8CVE-2013-0074Microsoft Silverlight pointer validation flaw enables remote code executionMicrosoft Silverlight 5 and the 5 Developer Runtime before 5.1.20125.0 fail to properly validate pointers during HTML object rendering. A crafted Sil…KEVEPSS 79%analysed7.5CVE-2024-29059Microsoft .NET Framework error message information disclosureCVE-2024-29059 is an information disclosure flaw in Microsoft .NET Framework, classified as CWE-209 (error message information leak). A remote, unaut…KEVEPSS 99%analysed5.5CVE-2013-3896Microsoft Silverlight pointer validation flaw leaks sensitive informationMicrosoft Silverlight 5 before 5.1.20913.0 fails to properly validate pointers during access to Silverlight elements, allowing a crafted Silverlight …KEVEPSS 68%analysed

Source: NIST National Vulnerability Database (record CVE-2012-0014), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.