CVE-2024-29059
.NET Framework Information Disclosure Vulnerability
.NET Framework Information Disclosure Vulnerability
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
.NET Framework Information Disclosure Vulnerability
.NET Framework Information Disclosure Vulnerability
- Record
CVE-2024-29059- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - Weakness
- CWE-209
- Updated
- 2026-11-02
EUVDEUVD-2024-26106
.NET Framework Information Disclosure Vulnerability
- Record
EUVD-2024-26106- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pg2q-wfgh-r323
.NET Framework Information Disclosure Vulnerability
.NET Framework Information Disclosure Vulnerability
- Record
GHSA-pg2q-wfgh-r323- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
CISA KEV No score
Microsoft .NET Framework Information Disclosure Vulnerability
Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.
- Record
CVE-2024-29059- Weakness
- CWE-209
- Updated
- 2026-11-02
NVD
.NET Framework Information Disclosure Vulnerability
- Record
CVE-2024-29059- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
Affected products
- microsoft .net framework
- microsoft .net framework 2.0 service pack 2
- microsoft .net framework 3.0 service pack 2
- microsoft .net framework 3.5
- microsoft .net framework 3.5 and 4.6/4.6.2
- microsoft .net framework 3.5 and 4.7.2
- microsoft .net framework 3.5 and 4.8
- microsoft .net framework 3.5 and 4.8.1
- microsoft .net framework 3.5.1
- microsoft .net framework 4.6.2
- microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2
- microsoft .net framework 4.8
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | codewhitesec/HttpRemotingObjRefLeak | 2024-03-11 |
| Nuclei | .NET Framework - Leaking ObjRefs via HTTP .NET Remoting |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-29059 is a high vulnerability (CVSS 7.5) in Microsoft .net Framework, published March 22, 2024. CISA lists it as known to be exploited, since February 4, 2025. EUVD reports exploitation since February 4, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.6%, the 99th percentile. No source names a fixed version.