CVE-2025-21176

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Published Jan 14, 2025 CVSS 3.1 · 8.8 High EPSS 2.4% KEV · Not listed

Description

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

.NET 8.0

affected

Version	Status	Constraints
`8.0.0`	affected	< 8.0.12

Microsoft

.NET 9.0

affected

Version	Status	Constraints
`9.0.0`	affected	< 9.0.1

Microsoft

Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2

affected

Version	Status	Constraints
`3.0.0.0`	affected	< 10.0.14393.7699

Microsoft

Microsoft .NET Framework 3.5 AND 4.7.2

affected

Version	Status	Constraints
`4.7.0`	affected	< 4.7.04126.01

Microsoft

Microsoft .NET Framework 3.5 AND 4.8

affected

Version	Status	Constraints
`4.8.0`	affected	< 4.8.04775.01

Microsoft

Microsoft .NET Framework 3.5 AND 4.8.1

affected

Version	Status	Constraints
`4.8.1`	affected	< 4.8.1.09294.01

Microsoft

Microsoft .NET Framework 4.6.2

affected

Version	Status	Constraints
`4.7.0`	affected	< 4.7.04126.01

Microsoft

Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2

affected

Version	Status	Constraints
`4.7.0`	affected	< 4.7.04126.01

Microsoft

Microsoft .NET Framework 4.6/4.6.2

affected

Version	Status	Constraints
`10.0.0.0`	affected	< 10.0.10240.20890

Microsoft

Microsoft .NET Framework 4.8

affected

Version	Status	Constraints
`4.8.0`	affected	< 4.8.04775.01

Microsoft

Microsoft Visual Studio 2015 Update 3

affected

Version	Status	Constraints
`14.0.0`	affected	< 14.0.24252.2

Microsoft

Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)

affected

Version	Status	Constraints
`15.9.0`	affected	< 15.9.69

Microsoft

Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)

affected

Version	Status	Constraints
`16.11.0`	affected	< 16.11.43

Microsoft

Microsoft Visual Studio 2022 version 17.10

affected

Version	Status	Constraints
`17.10.0`	affected	< 17.10.10

Microsoft

Microsoft Visual Studio 2022 version 17.12

affected

Version	Status	Constraints
`17.12.0`	affected	< 17.12.4

Microsoft

Microsoft Visual Studio 2022 version 17.6

affected

Version	Status	Constraints
`17.6.0`	affected	< 17.6.22

Microsoft

Microsoft Visual Studio 2022 version 17.8

affected

Version	Status	Constraints
`17.8.0`	affected	< 17.8.17

Configuration 1 [-]

AND

cpe:2.3:a:microsoft:.net:8.0.0:-:*:*:*:*:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

Configuration 2 [-]

cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:*

Configuration 3 [-]

AND

OR	cpe:2.3:a:microsoft:.net_framework:4.6:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.6.2:::::::*

cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

Configuration 5 [-]

AND

OR	cpe:2.3:a:microsoft:.net_framework:3.5:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.8.1:::::::*

OR	cpe:2.3:o:microsoft:windows_10_21h2:-:::::::*
	cpe:2.3:o:microsoft:windows_10_22h2:-:::::::*
	cpe:2.3:o:microsoft:windows_11_22h2:-:::::::*
	cpe:2.3:o:microsoft:windows_11_23h2:-:::::::*
	cpe:2.3:o:microsoft:windows_11_24h2:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2022:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2022_23h2:-:::::::*

Configuration 6 [-]

AND

OR	cpe:2.3:a:microsoft:.net_framework:4.6.2:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.7:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.7.1:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.7.2:::::::*

OR	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*

Configuration 7 [-]

AND

OR	cpe:2.3:a:microsoft:.net_framework:3.5:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.6.2:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.7:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.7.1:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.7.2:::::::*

OR	cpe:2.3:o:microsoft:windows_10_1607:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_1607:-::::::x86:

Configuration 8 [-]

AND

OR	cpe:2.3:a:microsoft:.net_framework:3.5:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.7.2:::::::*

OR	cpe:2.3:o:microsoft:windows_10_1809:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_1809:-::::::x86:
	cpe:2.3:o:microsoft:windows_10_21h2:-:::::::*
	cpe:2.3:o:microsoft:windows_10_22h2:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2019:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2022:-:::::::*

Configuration 9 [-]

AND

cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_10_1607:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_1607:-::::::x86:
	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:-:::::::*

Configuration 10 [-]

AND

cpe:2.3:a:microsoft:.net:9.0.0:*:*:*:*:*:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
dotnet8.0-0:8.0.112-1.el8_10	cpe:/a:redhat:enterprise_linux:8	RHSA-2025:0381	2025-01-16T00:00:00Z
dotnet9.0-0:9.0.102-1.el8_10	cpe:/a:redhat:enterprise_linux:8	RHSA-2025:0382	2025-01-16T00:00:00Z
Red Hat Enterprise Linux 9
dotnet8.0-0:8.0.112-1.el9_5	cpe:/a:redhat:enterprise_linux:9	RHBA-2025:0304	2025-01-14T00:00:00Z
dotnet9.0-0:9.0.102-1.el9_5	cpe:/a:redhat:enterprise_linux:9	RHBA-2025:0305	2025-01-14T00:00:00Z
Red Hat Enterprise Linux 9.4 Extended Update Support
dotnet8.0-0:8.0.112-1.el9_4	cpe:/a:redhat:rhel_eus:9.4	RHSA-2025:0532	2025-01-21T00:00:00Z

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-0073	.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
Github GHSA	GHSA-gjf6-3w4p-7xfh	Microsoft Security Advisory CVE-2025-21176 \| .NET and Visual Studio Remote Code Execution Vulnerability
Ubuntu USN	USN-7210-1	.NET vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 2.4% (2.381% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21176
https://nvd.nist.gov/vuln/detail/CVE-2025-21176
https://www.cve.org/CVERecord?id=CVE-2025-21176
https://www.herodevs.com/vulnerability-directory/cve-2025-21176

History

Feb 13, 2026 8:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Microsoft visual Studio 2015 Microsoft visual Studio 2019 Microsoft visual Studio 2022
CPEs		cpe:2.3:a:microsoft:.net:::::::: cpe:2.3:a:microsoft:.net_framework:::::::: cpe:2.3:a:microsoft:visual_studio_2015::update3::::::* cpe:2.3:a:microsoft:visual_studio_2019:::::::: cpe:2.3:a:microsoft:visual_studio_2022::::::::
Vendors & Products		Microsoft visual Studio 2015 Microsoft visual Studio 2019 Microsoft visual Studio 2022

Jul 16, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00528}`	epss `{'score': 0.00625}`

May 6, 2025 3:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://www.herodevs.com/vulnerability-directory/cve-2025-21176

Apr 16, 2025 8:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:a:microsoft:.net:8.0.0:-:::::: cpe:2.3:o:linux:linux_kernel:-:::::::*
Vendors & Products		Linux Linux linux Kernel

Feb 13, 2025 1:00 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat enterprise Linux Redhat rhel Eus
CPEs		cpe:/a:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:9 cpe:/a:redhat:rhel_eus:9.4
Vendors & Products		Redhat Redhat enterprise Linux Redhat rhel Eus

Feb 5, 2025 7:30 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Microsoft Microsoft .net Microsoft .net Framework Microsoft visual Studio 2017 Microsoft windows Microsoft windows 10 1507 Microsoft windows 10 1607 Microsoft windows 10 1809 Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows Server 2008 Microsoft windows Server 2012 Microsoft windows Server 2016 Microsoft windows Server 2019 Microsoft windows Server 2022 Microsoft windows Server 2022 23h2
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:microsoft:.net:9.0.0:::::::* cpe:2.3:a:microsoft:.net_framework:3.5:::::::* cpe:2.3:a:microsoft:.net_framework:4.6.2:::::::* cpe:2.3:a:microsoft:.net_framework:4.6:::::::* cpe:2.3:a:microsoft:.net_framework:4.7.1:::::::* cpe:2.3:a:microsoft:.net_framework:4.7.2:::::::* cpe:2.3:a:microsoft:.net_framework:4.7:::::::* cpe:2.3:a:microsoft:.net_framework:4.8.1:::::::* cpe:2.3:a:microsoft:.net_framework:4.8:::::::* cpe:2.3:a:microsoft:visual_studio_2017:::::::: cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:o:microsoft:windows_10_1507:-:::::::* cpe:2.3:o:microsoft:windows_10_1607:-::::::x64: cpe:2.3:o:microsoft:windows_10_1607:-::::::x86: cpe:2.3:o:microsoft:windows_10_1809:-::::::x64: cpe:2.3:o:microsoft:windows_10_1809:-::::::x86: cpe:2.3:o:microsoft:windows_10_21h2:-:::::::* cpe:2.3:o:microsoft:windows_10_22h2:-:::::::* cpe:2.3:o:microsoft:windows_11_22h2:-:::::::* cpe:2.3:o:microsoft:windows_11_23h2:-:::::::* cpe:2.3:o:microsoft:windows_11_24h2:-:::::::* cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::: cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:* cpe:2.3:o:microsoft:windows_server_2012:-:::::::* cpe:2.3:o:microsoft:windows_server_2012:r2:::::::* cpe:2.3:o:microsoft:windows_server_2016:-:::::::* cpe:2.3:o:microsoft:windows_server_2019:-:::::::* cpe:2.3:o:microsoft:windows_server_2022:-:::::::* cpe:2.3:o:microsoft:windows_server_2022_23h2:-:::::::*
Vendors & Products		Apple Apple macos Microsoft Microsoft .net Microsoft .net Framework Microsoft visual Studio 2017 Microsoft windows Microsoft windows 10 1507 Microsoft windows 10 1607 Microsoft windows 10 1809 Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows Server 2008 Microsoft windows Server 2012 Microsoft windows Server 2016 Microsoft windows Server 2019 Microsoft windows Server 2022 Microsoft windows Server 2022 23h2

Jan 15, 2025 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jan 15, 2025 1:45 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2025-21176 https://www.cve.org/CVERecord?id=CVE-2025-21176
Metrics	threat_severity `None`	threat_severity `Important`

Jan 14, 2025 6:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
Title		.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
Weaknesses		CWE-126
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21176
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

Earlier changes (4)

Subscriptions

Apple Macos

Linux Linux Kernel

Microsoft .net .net Framework Visual Studio 2015 Visual Studio 2017 Visual Studio 2019 Visual Studio 2022 Windows Windows 10 1507 Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 22h2 Windows 11 23h2 Windows 11 24h2 Windows Server 2008 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2022 23h2