dbcve.org
.net FrameworkApplication · Microsoft

CVE-2010-3958

HIGH · 9.3 CVSS v2.0 Published 2011-04-13
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
The x86 JIT compiler in Microsoft .NET Framework 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 does not properly compile function calls, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework Stack Corruption Vulnerability."

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A vulnerability in the x86 JIT (Just-In-Time) compiler in Microsoft .NET Framework versions 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 causes improper compilation of function calls, leading to stack corruption. Remote attackers can exploit this by delivering crafted XBAP applications, ASP.NET applications, or standalone .NET applications to achieve arbitrary code execution on vulnerable systems.

MitigationApply Microsoft security update MS11-028 which addresses this JIT compiler vulnerability. As a defense-in-depth measure, disable XAML browser applications (XBAP) in Internet Explorer and review .NET code access security policies to restrict untrusted code execution.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
.net FrameworkApplication
Affected:= 4.0= 3.5.1= 2.0= 3.5

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
M
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete

AV:N/AC:M/Au:N/C:C/I:C/A:C

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify installed .NET Framework version
    Check the Windows registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full (for .NET 4.0) or HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v3.5 (for .NET 3.5/3.5.1) or HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0 (for .NET 2.0). Use command: reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Version
    Affected if The installed version matches 2.0 SP2, 3.5 SP1, 3.5.1, or 4.0 exactly. Note that .NET versions prior to these or patched versions after MS11-028 are not affected.
  2. Confirm JIT compilation is enabled
    The JIT compiler is enabled by default in .NET Framework. Verify by checking that .NET applications can execute. Use: gci C:\Windows\Microsoft.NET\Framework -Directory | Select-Object Name
    Affected if JIT compilation is enabled (default state). The vulnerability only applies when JIT compilation is active.
  3. Determine if XBAP functionality is in use
    Check if .NET Framework XAML Browser Applications (XBAP) are enabled. In Internet Explorer, this is controlled via the .NET Framework configuration tool or Internet Explorer security settings. Check registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\XBAP (if present)
    Affected if XBAP is enabled and Internet Explorer or other browsers can load XBAP applications. This is one of the primary delivery mechanisms for this vulnerability.
  4. Check for hosted ASP.NET applications
    Review IIS or other web servers for installed ASP.NET applications. Check: %SystemRoot%\Microsoft.NET\Framework\v*\CONFIG\web.config or use IIS Manager to list ASP.NET applications
    Affected if ASP.NET applications are hosted and accessible over the network. Attackers can deliver crafted .NET applications through ASP.NET to trigger the JIT vulnerability.

Your environment is affected if .NET Framework version 2.0 SP2, 3.5 SP1, 3.5.1, or 4.0 is installed with JIT compilation enabled and the system runs or hosts untrusted .NET applications (XBAP, ASP.NET, or standalone apps) that could trigger the vulnerable JIT compiler path.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply Microsoft security update MS11-028 which addresses this JIT compiler vulnerability. As a defense-in-depth measure, disable XAML browser applications (XBAP) in Internet Explorer and review .NET code access security policies to restrict untrusted code execution.

Recommended fix High confidence

This vulnerability was addressed via security patches (MS10-060), not version upgrades. The affected .NET Framework versions (2.0 SP2, 3.5 SP1, 3.5.1, 4.0) are legacy products that receive patches rather than newer releases. For modern .NET, consider migrating to .NET Framework 4.8 LTS or .NET 6/7/8

  1. Apply Microsoft Security Bulletin MS10-060 which addresses this JIT compiler vulnerability
  2. For .NET Framework 2.0 SP2 and 3.5 SP1: Install security update KB983587 from Microsoft Update
  3. For .NET Framework 3.5.1: Install security update KB983588 from Microsoft Update
  4. For .NET Framework 4.0: Install security update KB983590 from Microsoft Update
  5. Alternatively, verify patches are installed by checking for these KB articles in Windows Update > View update history
  6. After patching, verify the .NET Framework version remains compatible with your applications
Caveat Patches for legacy .NET Framework versions typically have minimal breaking changes but may require application restart. Ensure testing in staging environment before deploying widely.

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in .net Framework Scoped from the published advisory
  • Consultation3.0 h
  • Implementation6.0 h
  • Testing6.0 h
  • Review / QA3.0 h
18.0 hours of engineering $3,120
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,992.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2010-3958 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2010-3958 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data