CVE-2012-4777: Microsoft .NET Framework

High severity, CVSS 9.3. EPSS: 24.8% chance of exploitation in the next 30 days.

The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and 4.5 does not properly enforce object permissions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka "WPF Reflection Optimization Vulnerability."

Affected products

• Microsoft .NET Framework: version 4.0 only; version 4.5 only

Published 2012-11-14. Last modified 2026-06-16.