VYPR
← All advisories
High severityNVD Advisory· Published Jun 13, 2025· Updated Feb 20, 2026

.NET and Visual Studio Remote Code Execution Vulnerability

CVE-2025-30399

Description

Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

.NET and Visual Studio untrusted search path vulnerability allows an unauthorized attacker to execute code over a network by placing files in specific locations.

CVE-2025-30399 is an untrusted search path vulnerability affecting .NET 8.0, .NET 9.0, and Visual Studio. The root cause is that the application searches for required resources in locations that an attacker may be able to control, leading to the loading of unintended files. This vulnerability is classified as a remote code execution issue over a network [1][2].

An attacker can exploit this vulnerability by placing malicious files in particular locations on the system. The attack is performed over a network, meaning the attacker does not require local access to the vulnerable machine. No mitigating factors have been identified by Microsoft, indicating that any affected application exposed to an untrusted network path is at risk [1][2].

If successfully exploited, the attacker can achieve unintended code execution within the context of the .NET application. This could lead to full compromise of the application, data access, or lateral movement within the network. The impact is considered high, as it bypasses standard security boundaries for network-based interactions [1][2].

Microsoft has released patches for the affected component packages. For .NET 8.0, the vulnerable versions are 8.0.16 and earlier, with the fix included in version 8.0.17. For .NET 9.0, versions 9.0.5 and earlier are affected, and the patch is in version 9.0.6. Developers should update their applications to use the patched packages immediately [1][2].

References
  1. Microsoft Security Advisory CVE-2025-30399 | .NET Remote Code Vulnerability
  2. Microsoft Security Advisory CVE-2025-30399 | .NET Remote Code Vulnerability

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.NetCore.App.Runtime.linux-armNuGet
>= 9.0.0, < 9.0.69.0.6
Microsoft.NetCore.App.Runtime.linux-arm64NuGet
>= 9.0.0, < 9.0.69.0.6
Microsoft.NetCore.App.Runtime.linux-musl-armNuGet
>= 9.0.0, < 9.0.69.0.6
Microsoft.NetCore.App.Runtime.linux-musl-arm64NuGet
>= 9.0.0, < 9.0.69.0.6
Microsoft.NetCore.App.Runtime.linux-musl-x64NuGet
>= 9.0.0, < 9.0.69.0.6
Microsoft.NetCore.App.Runtime.linux-x64NuGet
>= 9.0.0, < 9.0.69.0.6
Microsoft.NetCore.App.Runtime.osx-arm64NuGet
>= 9.0.0, < 9.0.69.0.6
Microsoft.NetCore.App.Runtime.osx-x64NuGet
>= 9.0.0, < 9.0.69.0.6
Microsoft.NetCore.App.Runtime.win-armNuGet
>= 9.0.0, < 9.0.69.0.6
Microsoft.NetCore.App.Runtime.win-arm64NuGet
>= 9.0.0, < 9.0.69.0.6
Microsoft.NetCore.App.Runtime.win-x64NuGet
>= 9.0.0, < 9.0.69.0.6
Microsoft.NetCore.App.Runtime.win-x86NuGet
>= 9.0.0, < 9.0.69.0.6
Microsoft.NetCore.App.Runtime.linux-armNuGet
>= 8.0.0, < 8.0.178.0.17
Microsoft.NetCore.App.Runtime.linux-arm64NuGet
>= 8.0.0, < 8.0.178.0.17
Microsoft.NetCore.App.Runtime.linux-musl-armNuGet
>= 8.0.0, < 8.0.178.0.17
Microsoft.NetCore.App.Runtime.linux-musl-arm64NuGet
>= 8.0.0, < 8.0.178.0.17
Microsoft.NetCore.App.Runtime.linux-musl-x64NuGet
>= 8.0.0, < 8.0.178.0.17
Microsoft.NetCore.App.Runtime.linux-x64NuGet
>= 8.0.0, < 8.0.178.0.17
Microsoft.NetCore.App.Runtime.osx-arm64NuGet
>= 8.0.0, < 8.0.178.0.17
Microsoft.NetCore.App.Runtime.osx-x64NuGet
>= 8.0.0, < 8.0.178.0.17
Microsoft.NetCore.App.Runtime.win-armNuGet
>= 8.0.0, < 8.0.178.0.17
Microsoft.NetCore.App.Runtime.win-arm64NuGet
>= 8.0.0, < 8.0.178.0.17
Microsoft.NetCore.App.Runtime.win-x64NuGet
>= 8.0.0, < 8.0.178.0.17
Microsoft.NetCore.App.Runtime.win-x86NuGet
>= 8.0.0, < 8.0.178.0.17

Affected products

57

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.