CVE-2012-4777
The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and...
The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and 4.5 does not properly enforce object permissions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka "WPF Reflection Optimization Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and 4.5 does not properly enforce object permissions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka "WPF Reflection Optimization Vulnerability."
- Record
CVE-2012-4777- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and 4.5 does not properly enforce object permissions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka "WPF Reflection Optimization Vulnerability."
- Record
CVE-2012-4777- Updated
- 2026-11-02
EUVDEUVD-2012-4702 No score
The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and 4.5 does not properly enforce object permissions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka "WPF Reflection Optimization Vulnerability."
- Record
EUVD-2012-4702- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-69xc-62mc-6v46 No score
The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and...
The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and 4.5 does not properly enforce object permissions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka "WPF Reflection Optimization Vulnerability."
- Record
GHSA-69xc-62mc-6v46- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-4777 is a high vulnerability (CVSS 9.3) in Microsoft .net Framework, published November 14, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 24.8%, the 97th percentile. No source names a fixed version.
References
us-cert.gov/cas/techalerts/TA12-318A.html
docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-074
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15960
osvdb.org/87267
securityfocus.com/bid/56464
secunia.com/advisories/51236
securitytracker.com/id?1027753
nvd.nist.gov/vuln/detail/CVE-2012-4777
github.com/advisories/GHSA-69xc-62mc-6v46