Skip to content
Threat Feed
Subscribe
critical advisory

System.Linq.Dynamic.Core: Remote Code Execution (CVE-2023-32571)

CVE-2023-32571 is a critical remote code execution vulnerability in System.Linq.Dynamic.Core affecting versions 1.0.7.10 through 1.2.25, triggered by the parsing of untrusted input in LINQ query methods.

CVE search metadata

CVE search record: CVE-2023-32571. Severity: critical. CVSS: 9.8. EPSS: 34.90%. KEV: no. Product: System.Linq.Dynamic.Core (1.0.7.10 - 1.2.25). Brief: System.Linq.Dynamic.Core: Remote Code Execution (CVE-2023-32571). Brief link: https://feed.craftedsignal.io/briefs/2026-10-system-linq-dynamic-core-rce/

Triage facts

Revision 1
Applicability
System.Linq.Dynamic.Core (1.0.7.10 - 1.2.25)
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
3 public sources
Freshness
Revision 1Oct 24, 21:31 UTC
Vulnerabilities
1 CVE
Source quality
A1Very likely

CVE-2023-32571 is a remote code execution vulnerability in the System.Linq.Dynamic.Core library. The flaw exists in the way the library parses untrusted input within specific LINQ methods, including Where, Select, and OrderBy. Successful exploitation allows for arbitrary assembly loading or direct system command execution. A public proof-of-concept exploit is available, demonstrating both assembly injection and direct process spawning.

Impact

The vulnerability allows unauthenticated, remote attackers to achieve full remote code execution on the underlying host. The CVSS score is 9.8 (Critical), reflecting the ability to achieve high levels of confidentiality, integrity, and availability impact without requiring user interaction or privileges.

Recommendation

  1. Inventory applications using the System.Linq.Dynamic.Core library to identify instances running versions within the 1.0.7.10 to 1.2.25 range.
  2. Update the library dependency to a version beyond 1.2.25 to remediate the vulnerability.
  3. Implement strict input validation for all data passed to LINQ query methods if immediate patching is not possible.

Immediate actions

Patch System.Linq.Dynamic.Core to 1.3.0 or later

AppSec 24h

Threat Hunt

Monitor web application server logs for anomalous execution patterns in query parameters that invoke LINQ filtering or sorting

T1059 high high confidence hunt now

Data: Web application logs, Endpoint process execution logs

Mitigations

Upgrade System.Linq.Dynamic.Core to version > 1.2.25

immediate IT Operations

CVE-2023-32571