CVE-2013-0073

Published: Feb 13, 2013Modified: Apr 29, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

The Windows Forms (aka WinForms) component in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly restrict the privileges of a callback function during object creation, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "WinForms Callback Elevation Vulnerability."

Affected (5)

Products: Microsoft: .net Framework

Microsoft

1 product

.net Framework

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 3.5

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 3.5.1

Configuration C

1 vulnerable · 5 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 4.0

Running on/with	Platform Versions
Microsoft Windows 7	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	Version r2
Microsoft Windows Server 2008	Version r2
Microsoft Windows Xp	Version sp2 professional

Configuration D

1 vulnerable · 5 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 4.5

Running on/with	Platform Versions
Microsoft Windows 7	All versions
Microsoft Windows 7	All versions
Microsoft Windows 8	All versions
Microsoft Windows 8	All versions
Microsoft Windows Server 2012	All versions

Configuration E

1 vulnerable · 8 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 2.0 sp2

Running on/with	Platform Versions
Microsoft Windows Server 2003	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Vista	All versions
Microsoft Windows Vista	All versions
Microsoft Windows Xp	All versions
Microsoft Windows Xp	All versions