VYPR
← All advisories
High severityNVD Advisory· Published Jan 14, 2025· Updated Feb 26, 2026

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

CVE-2025-21176

Description

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A buffer over-read vulnerability in DiaSymReader.dll allows remote code execution in .NET, .NET Framework, and Visual Studio via specially crafted files.

Root

Cause

CVE-2025-21176 is a high-severity remote code execution vulnerability in .NET, .NET Framework, and Visual Studio. The issue resides in the DiaSymReader.dll component, which suffers from a buffer over-read (CWE-126). Insufficient input validation allows an attacker to craft a file that, when loaded by the affected application, reads beyond the intended buffer boundary [1][3].

Exploitation

The vulnerability is triggered by loading a specially crafted file into Visual Studio or any .NET application that uses the affected runtime versions. The attack does not require authentication but relies on the victim opening the malicious file. The vulnerable software includes .NET 6.0.0 through 6.0.36, .NET 8.0.0 through 8.0.11, and .NET 9.0.0. All platform-specific NuGet packages (linux, osx, win) and self-contained deployments are affected [1][3].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the application. This could lead to full system compromise, data theft, or further lateral movement within a network. The vulnerability is listed as remote code execution, and because Visual Studio is a development tool, crafted project files or solution files could be used as vectors [3].

Mitigation

Microsoft has released patched versions: .NET 8.0.12 and .NET 9.0.1. For .NET 6.0, which is out of standard support, a fix is available through HeroDevs' Never-Ending Support (NES) v6.1.0. Users must update their runtime and SDK, and any self-contained applications must be recompiled and redeployed. No workarounds have been provided, and the vulnerability is not currently listed on the CISA KEV [1][3].

References
  1. Microsoft Security Advisory CVE-2025-21176 | .NET and Visual Studio Remote Code Execution Vulnerability
  2. Vulnerability Directory | CVE-2025-21176 | .NET

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.NetCore.App.Runtime.linux-armNuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.linux-arm64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.linux-musl-armNuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.linux-musl-arm64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.linux-musl-x64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.linux-x64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.osx-arm64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.osx-x64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.win-armNuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.win-arm64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.win-x64NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.win-x86NuGet
>= 9.0.0, < 9.0.19.0.1
Microsoft.NetCore.App.Runtime.linux-armNuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.linux-arm64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.linux-musl-armNuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.linux-musl-arm64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.linux-musl-x64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.linux-x64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.osx-arm64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.osx-x64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.win-armNuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.win-arm64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.win-x64NuGet
>= 8.0.0, < 8.0.128.0.12
Microsoft.NetCore.App.Runtime.win-x86NuGet
>= 8.0.0, < 8.0.128.0.12

Affected products

64

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.