CVE-2016-0148

Published: Apr 12, 2016Modified: May 6, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Microsoft .NET Framework 4.6 and 4.6.1 mishandles library loading, which allows local users to gain privileges via a crafted application, aka ".NET Framework Remote Code Execution Vulnerability."

Affected (2)

Products: Microsoft: .net Framework

Microsoft

1 product

.net Framework

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 4.6.1
Microsoft .net Framework	Version 4.6

Related CWEs

CWE-264

References (12)

http://packetstormsecurity.com/files/136671/.NET-Framework-4.6-DLL-Hijacking.html

Source: secure@microsoft.com

http://seclists.org/fulldisclosure/2016/Apr/42

Source: secure@microsoft.com

Mailing ListThird Party Advisory

http://www.securityfocus.com/archive/1/538063/100/0/threaded

Source: secure@microsoft.com

http://www.securitytracker.com/id/1035535

Source: secure@microsoft.com

Third Party Advisory

http://www.zerodayinitiative.com/advisories/ZDI-16-234

Source: secure@microsoft.com

Third Party Advisory

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-041

Source: secure@microsoft.com

http://packetstormsecurity.com/files/136671/.NET-Framework-4.6-DLL-Hijacking.html