.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

The version of Microsoft .NET 8 Core installed on the remote host is prior to 8.0.12. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)

  - .NET Elevation of Privilege Vulnerability (CVE-2025-21173)

  - .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-844 advisory.

    .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)

    .NET Elevation of Privilege Vulnerability (CVE-2025-21173)

    .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:0382 advisory.

    * dotnet: .NET Remote Code Execution Vulnerability (CVE-2025-21171)
    * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)
    * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173)
    * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

    * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173)

    * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

    * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)

    * dotnet: .NET Remote Code Execution Vulnerability (CVE-2025-21171)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-16778d3c88 advisory.

    This is the January 2025 security and bugfix release for .NET 8.0. It updates the SDK to version 8.0.112     and Runtime to version 8.0.12.

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.12/8.0.112.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.12/8.0.12.md


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-bd8f5a599b advisory.

    This is the January 2025 security and bugfix release for .NET 8.0. It updates the SDK to version 8.0.112     and Runtime to version 8.0.12.

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.12/8.0.112.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.12/8.0.12.md


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2eb86c0cbf advisory.

    This is the January 2025 security and bugfix release for .NET 9.0. It updates the SDK to version 9.0.102     and Runtime to version 9.0.1.

    Release Notes: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.1/9.0.1.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-0487787cb9 advisory.

    This is the January 2025 security and bugfix release for .NET 9.0. It updates the SDK to version 9.0.102     and Runtime to version 9.0.1.

    Release Notes: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.1/9.0.1.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0532 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.112 and .NET Runtime 8.0.12.Security Fix(es):

    * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173)

    * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

    * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:0382 advisory.

    * dotnet: .NET Remote Code Execution Vulnerability (CVE-2025-21171)
      * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)
      * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173)
      * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)


    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

      * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173)
      * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)
      * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)
      * dotnet: .NET Remote Code Execution Vulnerability (CVE-2025-21171)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:0381 advisory.

    * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)
      * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173)
      * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)


    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

      * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173)
      * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)
      * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-0381 advisory.

    [8.0.112-1.0.1]
    - Add support for Oracle Linux

    [8.0.112-1]
    - Update to .NET SDK 8.0.112 and Runtime 8.0.12
    - Resolves: RHEL-71554

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-0382 advisory.

  - .NET Remote Code Execution Vulnerability (CVE-2025-21171)

  - .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

  - .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)

  - .NET Elevation of Privilege Vulnerability (CVE-2025-21173)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7210-1 advisory.

    It was discovered that .NET did not properly handle input provided to its Convert.TryToHexString method.
    An attacker could possibly use this issue to execute arbitrary code. (CVE-2025-21171)

    It was discovered that .NET did not properly handle an integer overflow when processing certain specially     crafted files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2025-21172)

    Daniel Plaisted and Noah Gilson discovered that .NET insecurely handled temporary file usage which could     result in malicious package dependency injection. An attacker could possibly use this issue to elevate     privileges. (CVE-2025-21173)

    It was discovered that .NET did not properly perform input data validation when processing certain     specially crafted files. An attacker could possibly use this issue to execute arbitrary code.
    (CVE-2025-21176)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0382 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 9.0.102 and .NET Runtime 9.0.1.

    Security Fix(es):

    * dotnet: .NET Remote Code Execution Vulnerability (CVE-2025-21171)
    * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)
    * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173)
    * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

    * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173)

    * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

    * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)

    * dotnet: .NET Remote Code Execution Vulnerability (CVE-2025-21171)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0381 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.112 and .NET Runtime 8.0.1.12.

    Security Fix(es):

    * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)
    * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173)
    * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

    * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173)

    * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

    * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Framework installation on the remote host is missing a security update. It is, therefore, affected by multiple denial of service vulnerabilities, as follows:

  - A remote code execution vulnerability. An attacker can     exploit this issue to cause the affected component to     execute unauthorized code. (CVE-2025-21176)

Note that Nessus has relied upon on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by multiple vulnerabilities, including:

  - An undisclosed .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

  - An undisclosed Visual Studio Remote Code Execution Vulnerability (CVE-2025-21178)

  - An undisclosed .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by multiple vulnerabilities, including:

  - An undisclosed .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)

  - An undisclosed Visual Studio Remote Code Execution Vulnerability (CVE-2025-21178)

  - An undisclosed Visual Studio Elevation of Privilege Vulnerability (CVE-2025-21405)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
232847	Security Update for Microsoft .NET 8 Core (January 2025)	Nessus	Windows	high
216799	Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2025-844)	Nessus	Amazon Linux Local Security Checks	high
216299	RockyLinux 8 : .NET 9.0 (RLSA-2025:0382)	Nessus	Rocky Linux Local Security Checks	high
214754	Fedora 40 : dotnet8.0 (2025-16778d3c88)	Nessus	Fedora Local Security Checks	high
214752	Fedora 41 : dotnet8.0 (2025-bd8f5a599b)	Nessus	Fedora Local Security Checks	high
214749	Fedora 41 : dotnet9.0 (2025-2eb86c0cbf)	Nessus	Fedora Local Security Checks	high
214747	Fedora 40 : dotnet9.0 (2025-0487787cb9)	Nessus	Fedora Local Security Checks	high
214419	RHEL 9 : .NET 8.0 (RHSA-2025:0532)	Nessus	Red Hat Local Security Checks	high
214378	AlmaLinux 8 : .NET 9.0 (ALSA-2025:0382)	Nessus	Alma Linux Local Security Checks	high
214376	AlmaLinux 8 : .NET 8.0 (ALSA-2025:0381)	Nessus	Alma Linux Local Security Checks	high
214352	Oracle Linux 8 : .NET / 8.0 (ELSA-2025-0381)	Nessus	Oracle Linux Local Security Checks	high
214351	Oracle Linux 8 : .NET / 9.0 (ELSA-2025-0382)	Nessus	Oracle Linux Local Security Checks	high
214328	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : .NET vulnerabilities (USN-7210-1)	Nessus	Ubuntu Local Security Checks	high
214279	RHEL 8 : .NET 9.0 (RHSA-2025:0382)	Nessus	Red Hat Local Security Checks	high
214278	RHEL 8 : .NET 8.0 (RHSA-2025:0381)	Nessus	Red Hat Local Security Checks	high
214274	Security Updates for Microsoft .NET Framework (January 2025)	Nessus	Windows : Microsoft Bulletins	high
214126	Security Updates for Microsoft Visual Studio 2022 17.6 / 17.8 / 17.10 Products (January 2025)	Nessus	Windows : Microsoft Bulletins	high
214120	Security Updates for Microsoft Visual Studio 2022 17.12 Products (January 2025)	Nessus	Windows : Microsoft Bulletins	high
214119	Security Updates for Microsoft Visual Studio 2019 16.11 / 2017 15.9 Products (January 2025)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2025-21176

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high