CVE-2009-0091: Microsoft .NET Framework

High severity, CVSS 9.3. EPSS: 25.8% chance of exploitation in the next 30 days.

Microsoft .NET Framework 2.0, 2.0 SP1, and 3.5 does not properly enforce a certain type-equality constraint in .NET verifiable code, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "Microsoft .NET Framework Type Verification Vulnerability."

Affected products

• Microsoft .NET Framework: version 1.1 only; version 2.0 only; version 3.5 only; version 1.0 only
• Microsoft Windows 2000: any version
• Microsoft Windows 7: affected versions not specified
• Microsoft Windows Server 2003: any version
• Microsoft Windows Server 2008: any version; affected versions not specified
• Microsoft Windows Vista: any version
• Microsoft Windows XP: any version; affected versions not specified

Published 2009-10-14. Last modified 2026-06-16.