kbrain

CVE-2011-1271

HIGH · CVSS 7.7EPSS 20.1%EU EUVD

The JIT compiler in Microsoft .NET Framework 3.5 Gold and SP1, 3.5.1, and 4.0, when IsJITOptimizerDisabled is false, does not properly handle expressions related to null strings, which allows context-dependent attackers to bypass intended access restrictions, and consequently execute arbitrary code, in opportunistic circumstances by leveraging a crafted application, as demonstrated by (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework JIT Optimization Vulnerability."

Key facts

CVSS score
7.7 (v3.1)
Severity
HIGH
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weakness (CWE)
CWE-264
EPSS score
20.1% (97th percentile)
In CISA KEV
No
In EU EUVD
Yes (EUVD-2011-1279)
Published
May 10, 2011
NVD last modified
June 16, 2026
Status
Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2011-1279 in the EU Vulnerability Database. Last updated in EUVD on October 17, 2024.

View on the EU Vulnerability Database

Affected products

  • microsoft / .net framework
  • microsoft / .net framework
  • microsoft / .net framework
  • microsoft / .net framework
  • microsoft / .net framework
  • microsoft / .net framework
  • microsoft / windows 2003 server
  • microsoft / windows 7
  • microsoft / windows 7
  • microsoft / windows 7
  • microsoft / windows server 2003
  • microsoft / windows server 2008
  • microsoft / windows server 2008
  • microsoft / windows server 2008
  • microsoft / windows server 2008
  • microsoft / windows server 2008
  • microsoft / windows server 2008
  • microsoft / windows server 2008
  • microsoft / windows server 2008
  • microsoft / windows vista
  • microsoft / windows vista
  • microsoft / windows xp
  • microsoft / windows xp

References

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain