CVE-2024-43498: System.Formats.Nrbf Remote Code Execution Vulnerability
Summary
CVE-2024-43498: .NET Remote Code Execution Vulnerability. Affects System.Formats.Nrbf versions < 9.0.0. Fixed in 9.0.0. How to fix ↓
Also tracked for
- dotnet · Bitnami
- dotnet-sdk · Bitnami
The same CVE-2024-43498 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
System.Formats.Nrbf is a package in the .NET ecosystem that facilitates the serialization and deserialization of objects in the Nrbf format. This package is crucial for applications that require efficient data storage and transmission. However, vulnerabilities in this package can lead to severe security risks, particularly remote code execution, if exploited by malicious actors.
Vulnerability Detail
The vulnerability identified as CVE-2024-43498 allows remote unauthenticated attackers to exploit .NET applications using the System.Formats.Nrbf package. By sending specially crafted requests or files, attackers can execute arbitrary code on the server, potentially leading to data breaches, unauthorized access, and further exploitation of the system. This vulnerability affects any .NET 9.0 application running on versions prior to 9.0.0.
How To Fix
Latest published version: 10.0.13 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If your application does not use the NrbfDecoder component, it is not affected by this vulnerability. However, for those that do, a temporary workaround is to avoid processing untrusted data or requests until the package is updated.
Conclusion
CVE-2024-43498 is a critical vulnerability affecting the System.Formats.Nrbf package in .NET 9.0 applications. It allows remote code execution through specially crafted requests. It is essential to update the package and the .NET runtime to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for System.Formats.Nrbf →
FAQ
Check if your application uses the System.Formats.Nrbf package and ensure that it is not running on .NET 9.0.0.RC.2 or earlier versions.
Failing to address this vulnerability may expose your application to remote code execution attacks, leading to potential data loss, unauthorized access, and system compromise.
You can verify your .NET version by running the command 'dotnet --info' in your command line interface, which will display the installed SDKs and runtimes.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. It requires only the packages.config file to function.
You can find more information about CVE-2024-43498 in the Microsoft Security Advisory and on the CVE website.
Related vulnerabilities
Recent vulnerabilities recorded for System.Formats.Nrbf.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.