CVE-2024-29059: Microsoft .NET Framework Information Disclosure Vulnerability
Affects Microsoft .NET FrameworkSource CISA KEV
Exploited in the wild · KEV due 25 Feb 2025 · public detection template (Nuclei) · 98% EPSS : apply the vendor's fix or mitigations to Microsoft .NET Framework now.
Data as of 10/24/2026, 22:15:59 UTC
- Exploitation
Actively exploited – in CISA KEV since 02/04/2025
- KEV deadline
- 02/25/2025 US federal agencies must patch by this date; a sensible deadline for everyone else.
- EPSS
- 98.6% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Public exploits
- a Nuclei detection templatePublic attack or detection tooling exists; see Public exploits below.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:CWhat to do
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Public exploits and detection
Nuclei detection templates
Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.
Description
Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.
Weaknesses
- CWE-209Generation of Error Message Containing Sensitive Information (opens in a new tab)
Base weaknessLikelihood of exploit: HighOWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
The product generates an error message that includes sensitive information about its environment, users, or associated data.