Do not rely on folder names. Check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full to see the actual version installed.

| CVE ID | Vulnerability | CVSS Score | |--------|---------------|-------------| | | .NET Framework Denial of Service | 5.9 (Medium) |

Because Microsoft no longer monitors v4.0.30319 for new vulnerabilities, any bug discovered today becomes a de facto zero-day. In 2022, a researcher discovered an unpatched deserialization vulnerability in BinaryFormatter (still present in 4.0) that allows RCE via a crafted DataTable . Microsoft’s official response: "We recommend users upgrade to a supported version."