Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
38 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.NETCore.App.Runtime; System.Private.CoreLib. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Unix named-mutex and shared-memory paths can be manipulated through insecure global directories, symlink races, and unsafe permission changes, allowing local attackers to truncate or overwrite files, widen directory permissions, or elevate privileges. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/476 CVSS Details - Version: 3.1 - Severity: High - Score: 7.8 - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness: CWE-59 (Improper Link Resolution Before File Access ('Link Following')) Affected Platforms - Platforms: Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.NETCore.App.Runtime; System.Private.CoreLib. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Unix named-mutex and shared-memory paths can be manipulated through insecure global directories, symlink races, and unsafe permission changes, allowing local attackers to truncate or overwrite files, widen directory permissions, or elevate privileges. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/479 CVSS Details - Version: 3.1 - Severity: High - Score: 7.8 - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness: CWE-59 (Improper Link Resolution Before File Access ('Link Following')) Affected Platforms - Platforms: Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.Http. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. SocketsHttpHandler can retain a Proxy-Authorization header across an HTTP redirect and leak basic proxy credentials to the destination server. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/448 CVSS Details - Version: 3.1 - Severity: Moderate - Score: 5.9 - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness: CWE-201 (Insertion of Sensitive Information Into Sent Data) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- |…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/449 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-407 (Inefficient Algorithmic Complexity) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Runtime. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. DateTime Hebrew-number parsing can read outside expected stack bounds and terminate the process. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/481 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-787 (Out-of-bounds Write) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- Microsoft.NETCore.App.Runtime.linux-arm | = 10.0.0, <= 10.0.12 |…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0-rc.210.0.138.0.329.0.21· Vendor fix available
Issue
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml and System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/447 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-674 (Uncontrolled Recursion) Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.Security. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. .NET 11 post-handshake TLS client authentication can fail to verify the client certificate, allowing mutual-authentication requirements to be bypassed. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/464 CVSS Details - Version: 3.1 - Severity: Moderate - Score: 6.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness: CWE-295 (Improper Certificate Validation) Affected Platforms - Platforms: Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- |…
Recommended action: Upgrade to 11.0.0-rc.2 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET diagnostics IPC. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A missing error check in .NET causes an improper ACL to be applied to a shared resource, resulting in local elevation of privilege. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/429 CVSS Details - Version: 3.1 - Severity: Medium - Score: 6.7 - Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-252: Unchecked Return Value Affected Platforms - Platforms: Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET 10"</a.NET 10 Package name | Affected version | Patched version ------------ |…
Recommended action: Upgrade to 10.0.11, 9.0.19 or 8.0.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.WebSockets. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/428 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Weakness: CWE-606: Unchecked Input for Loop Condition Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET 10"</a.NET 10 Package name | Affected version | Patched version ------------ |…
Recommended action: Upgrade to 10.0.11, 9.0.19 or 8.0.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.HttpListener. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/427 CVSS Details - Version: 3.1 - Severity: Medium - Score: 5.9 - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - Weakness: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Affected Platforms - Platforms: Linux, macOS - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a…
Recommended action: Upgrade to 10.0.11, 9.0.19 or 8.0.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET HTTP client (System.Net.Http). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 8, .NET 9, and .NET 10 where an attacker can exploit the HTTP/2 protocol to cause an out-of-memory condition. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/422 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` - Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) Affected Platforms - Platforms: All - Architectures: All Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below .NET 10.0 Package name | Affected…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET SMTP client (System.Net.Mail). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A spoofing vulnerability exists in the SMTP client implementation (System.Net.Mail) in .NET 8, .NET 9, and .NET 10, where an attacker can spoof messages during message routing. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/TBD CVSS Details - Version: 3.1 - Severity: Medium - Score: 6.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness: CWE-116 (Improper Encoding or Escaping of Output) Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET 10.0"</a.NET 10.0 Package name |…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET TLS/SSL (System.Net.Security). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A security feature bypass vulnerability exists in .NET 8, .NET 9, and .NET 10 when processing TLS/SSL connections. An attacker can exploit the SslStream implementation to bypass authorization checks during secure communication. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/TBD CVSS Details - Version: 3.1 - Severity: High - Score: 8.2 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness: CWE-863 (Incorrect Authorization) Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET TLS/SSL (System.Net.Security). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 8, .NET 9, and .NET 10 when processing TLS handshakes. An attacker can send a malformed request and cause application to crash or become unresponsive. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/413 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C` - Weakness: CWE-1287 (Improper Validation of Specified Type of Input) Affected Platforms - Platforms: All - Architectures: All Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML processing (System.Security.Cryptography.Xml, System.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 8, .NET 9, and .NET 10 related to XML processing. An attacker can exploit XML encryption handling in XML parsing to cause excessive resource consumption or application crash. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/410 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness: CWE-770 (Allocation of Resources Without Limits or Throttling) Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET runtime cryptography layer (CryptoNative_GetX509NameInfo). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in the .NET 8, .NET 9, and .NET 10 runtime when parsing X.509 certificates. A specially crafted certificate could allow an attacker to cause a denial of service. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/408 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` - Weakness: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion')) Affected Platforms - Platforms: Linux, macOS - Architectures: All Affected Packages The vulnerability affects any Microsoft .NET project if it…
Recommended action: Upgrade to 10.0.10, 9.0.18 or 8.0.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in System.Net.Mail where specially crafted data allows an unauthorized attacker to perform a spoofing attack over the network. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/12345 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - Weakness: CWE-138: Improper Neutralization of Special Elements Affected Platforms - Platforms: All - Architectures: All <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below <a name=".NET 8"</a.NET 8 Package name | Affected version |…
Recommended action: Upgrade to 10.0.6, 9.0.15 or 8.0.26 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2026-26127 – .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0 and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET and Microsoft.Bcl.Memory due to an out-of-bounds read when decoding malformed Base64Url input. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/384 CVSS Details - Version: 3.1 - Score: 7.5 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - Severity: High - Weakness: CWE-129 (Improper Validation of Array Index); CWE-125 (Out-of-bounds Read) Affected Platforms - Platforms: All - Architectures: All Affected Products <a name=".NET 9"</a.NET 9 Package name | Affected version | Patched version ------------ | ---------------- |…
Recommended action: Upgrade to 10.0.4 or 9.0.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2026-26131 – .NET Elevation of Privilege Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An elevation of privilege vulnerability exists in .NET due to improper authorization. Incorrect packaging permissions could allow an attacker to gain elevated privileges. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/386 CVSS Details - Severity: High - Version: 3.1 - Score: 7.8 - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-276 (Incorrect Default Permissions) Affected Platforms - Platforms: Linux - Architectures: All Affected Products <a name=".NET 10"</a.NET 10 Package name | Affected version | Patched version ------------ | ---------------- |…
Recommended action: Upgrade to 10.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2025-55248 | .NET Information Disclosure Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A MITM (man in the middle) attacker may prevent use of TLS between client and SMTP server, forcing client to send data over unencrypted connection. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/372 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.20 or earlier. Any .NET 9.0 application running on .NET 9.0.9 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects…
Recommended action: Upgrade to 9.0.10 or 8.0.21 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2025-30399 | .NET Remote Code Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An attacker could exploit this vulnerability by placing files in particular locations, leading to unintended code execution. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/362 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.16 or earlier. Any .NET 9.0 application running on .NET 9.0.5 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it…
Recommended action: Upgrade to 9.0.6 or 8.0.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2025-21176 | .NET and Visual Studio Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An attacker could exploit this vulnerability by loading a specially crafted file in Visual Studio. Announcement Announcement for this issue can be found at https://github.com/dotnet/runtime/issues/111425 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.11 or earlier. Any .NET 9.0 application running on .NET 9.0.0 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it…
Recommended action: Upgrade to 9.0.1 or 8.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2025-21172 | .NET and Visual Studio Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An attacker could exploit this vulnerability by loading a specially crafted file in Visual Studio. Announcement Announcement for this issue can be found at https://github.com/dotnet/runtime/issues/111424. <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.11 or earlier. Any .NET 9.0 application running on .NET 9.0.0 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it…
Recommended action: Upgrade to 9.0.1 or 8.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2025-21171 | .NET Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An attacker could exploit this vulnerability by sending a specially crafted request to the vulnerable web server. Announcement Announcement for this issue can be found at https://github.com/dotnet/runtime/issues/111423 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 9.0 application running on .NET 9.0.0 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected packages versions listed below <a name=".NET 9"</a.NET 9…
Recommended action: Upgrade to 9.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2024-38167 | .NET Information Disclosure Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET runtime TlsStream which may result in Information Disclosure. Discussion Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/106359 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 8.0 application running on .NET 8.0.7 or earlier. <a name="affected-packages"</aAffected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below <a name=".NET 8"</a.NET 8 Package name |…
Recommended action: Upgrade to 8.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.