CVE-2012-4777

Published: Nov 14, 2012Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and 4.5 does not properly enforce object permissions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka "WPF Reflection Optimization Vulnerability."

Affected (2)

Products: Microsoft: .net Framework

Microsoft

1 product

.net Framework

Configuration A

1 vulnerable · 8 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 4.0

Running on/with	Platform Versions
Microsoft Windows 7	All versions
Microsoft Windows 7	All versions
Microsoft Windows Server 2003	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Xp	All versions
Microsoft Windows Xp	All versions

Configuration B

1 vulnerable · 9 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 4.5

Running on/with	Platform Versions
Microsoft Windows 7	All versions
Microsoft Windows 7	All versions
Microsoft Windows 8	All versions
Microsoft Windows 8	All versions
Microsoft Windows Rt	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2012	All versions
Microsoft Windows Vista	All versions