Most recent entries from all

ALSA-2025:0382 — Important: .NET 9.0 security update

2026-10-02T20:30:41.185806+00:00

Affected: AlmaLinux:8: aspnetcore-runtime-9.0, AlmaLinux:8: aspnetcore-runtime-dbg-9.0, AlmaLinux:8: aspnetcore-targeting-pack-9.0, AlmaLinux:8: dotnet, AlmaLinux:8: dotnet-apphost-pack-9.0, AlmaLinux:8: dotnet-host, AlmaLinux:8: dotnet-hostfxr-9.0, AlmaLinux:8: dotnet-runtime-9.0, AlmaLinux:8: dotnet-runtime-dbg-9.0, AlmaLinux:8: dotnet-sdk-9.0 and 6 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.102 and .NET Runtime 9.0.1.

Security Fix(es):

* dotnet: .NET Remote Code Execution Vulnerability (CVE-2025-21171) * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172) * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173) * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

* dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173) * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176) * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172) * dotnet: .NET Remote Code Execution Vulnerability (CVE-2025-21171)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-00434

2026-10-02T20:30:41.185939+00:00

bdu:2025-00434

BIT-dotnet-2025-21171 — .NET Remote Code Execution Vulnerability

2026-10-02T20:30:41.185967+00:00

Affected: Bitnami: dotnet

.NET Remote Code Execution Vulnerability

certfr-2025-avi-0039 — De multiples vulnérabilités ont été découvertes dans Microsoft Windows. Certaines d'entre elles permettent à un attaqua…

2026-10-02T20:30:41.185999+00:00

certfr-2025-avi-0039

cnvd-2025-04177

2026-10-02T20:30:41.186024+00:00

cnvd-2025-04177

EUVD-2026-326013

2026-10-02T20:30:41.186042+00:00

EUVD-2026-326013

fkie_cve-2025-21171

2026-10-02T20:30:41.186059+00:00

.NET Remote Code Execution Vulnerability

GHSA-p54p-p3qm-8vgj — Microsoft Security Advisory CVE-2025-21171 | .NET Remote Code Execution Vulnerability

2026-10-02T20:30:41.186088+00:00

Affected: NuGet: Microsoft.NetCore.App.Runtime.linux-arm, NuGet: Microsoft.NetCore.App.Runtime.linux-arm64, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm64, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-x64, NuGet: Microsoft.NetCore.App.Runtime.linux-x64, NuGet: Microsoft.NetCore.App.Runtime.osx-arm64, NuGet: Microsoft.NetCore.App.Runtime.osx-x64, NuGet: Microsoft.NetCore.App.Runtime.win-arm, NuGet: Microsoft.NetCore.App.Runtime.win-arm64 and 2 more

# Microsoft Security Advisory CVE-2025-21171 | .NET Remote Code Execution Vulnerability

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An attacker could exploit this vulnerability by sending a specially crafted request to the vulnerable web server.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/runtime/issues/111423

## Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

## Affected software

* Any .NET 9.0 application running on .NET 9.0.0 or earlier.

## Affected Packages

The vulnerability affects any Microsoft .NET project if it uses any of affected packages versions listed below

### .NET 9 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.NetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm) | >= 9.0.0, < 9.0.1 | 9.0.1 [Microsoft.NetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm64) | >= 9.0.0, < 9.0.1 | 9.0.1 [Microsoft.NetCore.App.Runtime.linu…

msrc_CVE-2025-21171 — .NET Remote Code Execution Vulnerability

2026-10-02T20:30:41.186208+00:00

msrc_CVE-2025-21171

RHBA-2025:0305 — Red Hat Bug Fix Advisory: .NET 9.0 bug fix and enhancement update

2026-10-02T20:30:41.186237+00:00

dotnet: .NET Remote Code Execution Vulnerability dotnet: .NET and Visual Studio Remote Code Execution Vulnerability dotnet: .NET Elevation of Privilege Vulnerability dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

UBUNTU-CVE-2025-21171

2026-10-02T20:30:41.186272+00:00

Affected: Ubuntu:22.04:LTS: dotnet7

.NET Remote Code Execution Vulnerability

WID-SEC-W-2025-0093 — Microsoft Developer Tools: Mehrere Schwachstellen

2026-10-02T20:30:41.186298+00:00

Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio 2017, Microsoft .NET Framework, Microsoft Windows Server 2012, Microsoft Windows Server 2012 R2, Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Visual Studio 2019, Microsoft Visual Studio 2022 und Microsoft Windows ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen und vertrauliche Informationen preiszugeben.