CVE-2012-1855: Microsoft .NET Framework

High severity, CVSS 9.3. EPSS: 20.5% chance of exploitation in the next 30 days.

Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly handle function pointers, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka ".NET Framework Memory Access Vulnerability."

Affected products

• Microsoft .NET Framework: version 2.0 only; version 3.5.1 only; version 4.0 only

Published 2012-06-12. Last modified 2026-06-16.