CVE-2024-0219 is a high severity (CVSS 7.8) privilege escalation in the installer component of Telerik JustDecompile, affecting versions before 2024 R1. A lower privileged user on a machine with an existing install can manipulate the installation package. Upgrade to 2024 R1 or later.
What's affected
The record says Telerik JustDecompile versions prior to 2024 R1 are affected. The flaw sits in the application's installer component and applies where an existing JustDecompile install is present on the machine.
The vendor knowledge base page linked from the record (a page titled legacy installer vulnerability) returned a not found error when we fetched it, so we could not read the vendor's remediation steps. Check the Telerik documentation for the current guidance before relying on this summary.
How to check if you're exposed
JustDecompile is a desktop tool, so the question is which machines have it. Developers, reverse engineers and security analysts are the usual users, and installs often sit on shared build machines too.
On Windows, look in Apps and features (or Programs and Features) for Telerik JustDecompile and note the displayed version. You can also query the installed program list from PowerShell:
Get-Package -Name '*JustDecompile*'
If your endpoint management tool keeps software inventory, search it for JustDecompile and sort by version. Anything older than 2024 R1 is in scope. Machines where several people have accounts, such as shared lab or build servers, deserve the first look because the attack needs a lower privileged user who has access to the machine.
What to do now
- Inventory JustDecompile installs across developer, analyst and build machines.
- Read the Telerik legacy installer vulnerability knowledge base entry for the vendor's steps.
- Upgrade to JustDecompile 2024 R1 or later.
- Remove old installer packages and cached installers from shared locations once the upgrade is done.
- If the tool is no longer needed on a machine, uninstall it.
Why it matters
The record describes a privilege elevation through the installer. In an environment where JustDecompile is already installed, a lower privileged user can manipulate the installation package and gain higher rights on the operating system. The weakness class is CWE-269, improper privilege management.
Installer and updater components are a recurring source of local escalation bugs, because they often run with administrator rights and handle files that users can reach. The CVSS vector marks attack complexity as high (AC:H), meaning the conditions are not trivial to arrange, and it needs low privileges but no user interaction, with a changed scope.
The record's KEV flag is false, and nothing we could read states exploitation. For most organisations this is a quick upgrade of a desktop tool. It is a bigger deal on shared machines, where a normal user gaining administrator rights is exactly the outcome you try to prevent.
Quick check
Who is affected by CVE-2024-0219?
Machines with Telerik JustDecompile older than 2024 R1 installed, where a lower privileged user can reach the installation package.
Is it exploited in the wild?
The record's KEV flag is false and we found no advisory text claiming exploitation.
Sources
- Telerik legacy installer vulnerability notes (returned not found when fetched, listed in the record)
- Telerik decompiler product page
- Gold entry for CVE-2024-0219
Last reviewed: 19 October 2026.
