Most recent entries from all

ALSA-2025:0381 — Important: .NET 8.0 security update

Affected: AlmaLinux:8: aspnetcore-runtime-8.0, AlmaLinux:8: aspnetcore-runtime-dbg-8.0, AlmaLinux:8: aspnetcore-targeting-pack-8.0, AlmaLinux:8: dotnet-apphost-pack-8.0, AlmaLinux:8: dotnet-hostfxr-8.0, AlmaLinux:8: dotnet-runtime-8.0, AlmaLinux:8: dotnet-runtime-dbg-8.0, AlmaLinux:8: dotnet-sdk-8.0, AlmaLinux:8: dotnet-sdk-8.0-source-built-artifacts, AlmaLinux:8: dotnet-sdk-dbg-8.0 and 2 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.112 and .NET Runtime 8.0.1.12.

Security Fix(es):

* dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172) * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173) * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

* dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173) * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176) * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-00588

BELL-CVE-2025-21176

Affected: Alpaquita:stream: dotnet8-runtime

BIT-dotnet-2025-21176 — .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Affected: Bitnami: dotnet

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

certfr-2025-avi-0039 — De multiples vulnérabilités ont été découvertes dans Microsoft Windows. Certaines d'entre elles permettent à un attaqua…

certfr-2025-avi-0039

EUVD-2026-326074

fkie_cve-2025-21176

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

GHSA-gjf6-3w4p-7xfh — Microsoft Security Advisory CVE-2025-21176 | .NET and Visual Studio Remote Code Execution Vulnerability

Affected: NuGet: Microsoft.NetCore.App.Runtime.linux-arm, NuGet: Microsoft.NetCore.App.Runtime.linux-arm64, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm64, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-x64, NuGet: Microsoft.NetCore.App.Runtime.linux-x64, NuGet: Microsoft.NetCore.App.Runtime.osx-arm64, NuGet: Microsoft.NetCore.App.Runtime.osx-x64, NuGet: Microsoft.NetCore.App.Runtime.win-arm, NuGet: Microsoft.NetCore.App.Runtime.win-arm64 and 2 more

# Microsoft Security Advisory CVE-2025-21176 | .NET and Visual Studio Remote Code Execution Vulnerability

## <a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An attacker could exploit this vulnerability by loading a specially crafted file in Visual Studio.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/runtime/issues/111425

## <a name="mitigation-factors"></a>Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

## <a name="affected-software"></a>Affected software

* Any .NET 8.0 application running on .NET 8.0.11 or earlier. * Any .NET 9.0 application running on .NET 9.0.0 or earlier.

## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected packages versions listed below

### <a name=".NET 9"></a>.NET 9 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.NetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm) | >= 9.0.0, < 9.0.1 | 9.0.1 [Microsoft.NetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm…

msrc_CVE-2025-21176 — .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

msrc_CVE-2025-21176

RHBA-2025:0304 — Red Hat Bug Fix Advisory: .NET 8.0 bug fix and enhancement update

npm-serialize-javascript: Cross-site Scripting (XSS) in serialize-javascript dotnet: .NET and Visual Studio Remote Code Execution Vulnerability dotnet: .NET Elevation of Privilege Vulnerability dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

RHSA-2025:0532 — Red Hat Security Advisory: .NET 8.0 security update

dotnet: .NET and Visual Studio Remote Code Execution Vulnerability dotnet: .NET Elevation of Privilege Vulnerability dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

UBUNTU-CVE-2025-21176

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet8

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

WID-SEC-W-2025-0093 — Microsoft Developer Tools: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio 2017, Microsoft .NET Framework, Microsoft Windows Server 2012, Microsoft Windows Server 2012 R2, Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Visual Studio 2019, Microsoft Visual Studio 2022 und Microsoft Windows ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen und vertrauliche Informationen preiszugeben.