VYPR
← All advisories
High severityNVD Advisory· Published Jan 14, 2025· Updated Feb 26, 2026

.NET and Visual Studio Remote Code Execution Vulnerability

CVE-2025-21172

Description

.NET and Visual Studio Remote Code Execution Vulnerability

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2025-21172 is a remote code execution vulnerability in .NET and Visual Studio caused by an integer overflow in msdia140.dll, exploitable via a malicious package file.

Vulnerability

Overview CVE-2025-21172 is a remote code execution vulnerability in .NET and Visual Studio, stemming from an integer overflow (CWE-190) that leads to a heap-based buffer overflow (CWE-122) in the msdia140.dll component [1][2][3]. This affects .NET 6.0 (up to 6.0.36), .NET 8.0 (up to 8.0.11), and .NET 9.0 (up to 9.0.0) [3].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted package file in Visual Studio [2][3]. The user interaction is required, and no authentication is needed beyond the user's session. Successful exploitation does not require any special privileges [2].

Impact

If exploited, an attacker can achieve remote code execution in the context of the current user, potentially allowing them to install programs, view, change, or delete data, or create new accounts with full user rights [2].

Mitigation

Microsoft has released patches to address this vulnerability: .NET 6.0.37, .NET 8.0.12, and .NET 9.0.1 [1]. Users should update their .NET SDK and runtime to the latest versions. Additionally, self-contained applications compiled against vulnerable versions must be recompiled and redeployed [3].

References
  1. Microsoft Security Advisory CVE-2025-21172 | .NET and Visual Studio Remote Code Execution Vulnerability
  2. NVD - CVE-2025-21172
  3. Vulnerability Directory | CVE-2025-21172 | .NET

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.NetCore.App.Runtime.linux-armNuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.linux-arm64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.linux-musl-armNuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.linux-musl-arm64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.linux-musl-x64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.linux-x64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.osx-arm64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.osx-x64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.win-armNuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.win-arm64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.win-x64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.win-x86NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.win-x64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.win-arm64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.win-armNuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.osx-x64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.osx-arm64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.linux-x64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.linux-musl-x64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.linux-musl-arm64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.linux-musl-armNuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.linux-arm64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.linux-armNuGet
>= 8.0.0, < 8.0.128.0.12

Affected products

53

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.