The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly hand…

published 2011-05-10 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-1279

cvss: 7.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 20.1%; EPSS 20.1% chance of exploitation in 30 days, percentile 97%
public exploits: 1; Exploit-DB

The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handle expressions related to null strings, which allows context-dependent attackers to bypass intended access restrictions, and consequently execute arbitrary code, in opportunistic circumstances by leveraging a crafted application, as demonstrated by (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework JIT Optimization Vulnerability."

Timeline

2011-03-04 First public exploit (EDB-35740)
2011-05-10 Published

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-01-10)

Exploit prediction

20.10% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-35740 Microsoft .NET Framework JIT Compiler - Optimization NULL String Remote Code Execution remote, 2011-03-04
stackoverflow.com http://stackoverflow.com/questions/2135509/bug-only-occurring-when-compile-optimization-enabled/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CNA	3.1	7.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
NVD	2.0	5.1	AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected products

microsoft .net_framework

Classification

Weakness

CWE-476 NULL Pointer Dereference
CWE-264 Permissions, Privileges, and Access Controls

References

stackoverflow.com /questions/2135509/bug-only-occurring-when-compile-optimization-enabled/
exploit
docs.microsoft.com /en-us/security-updates/securitybulletins/2011/ms11-044
vendor-advisory
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12686
vdb-entry, signature

Sources

CVE List CVE-2011-1271
NVD CVE-2011-1271

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary