TI-2025-34913 Aliases CVE-2025-55248 GHSA-gwq6-fmvp-qp68

.NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability

LOW 27CWE-326Published 2025-10-14 · Updated 2026-02-22

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 10 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub, Red Hat and Microsoft. Impact type from Microsoft.

Summary

Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00736 54th percentileScored 2026-11-07

Fix Partial Microsoft.NetCore.App.Runtime.linux-arm (NuGet): 9.0.10, 8.0.21Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): 9.0.10, 8.0.21+10 more productsRed Hat: 10 advisoriesMicrosoft: 16 updatesRed Hat: 10 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	.NET 8.0	8.0.0 to before 8.0.21	8.0.21	Patch available	CNA
Microsoft	.NET 9.0	9.0.0 to before 9.0.10	9.0.10	Patch available	CNA
Microsoft	Microsoft .NET Framework 2.0 Service Pack 2	2.0.0 to before 2.0.50727.8981	2.0.50727.8981	Patch available	CNA
Microsoft	Microsoft .NET Framework 3.0 Service Pack 2	3.0.0 to before 2.0.50727.8981	2.0.50727.8981	Patch available	CNA
Microsoft	Microsoft .NET Framework 3.5	3.5.0 to before 2.0.50727.8981	2.0.50727.8981	Patch available	CNA
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2	4.7.0 to before 4.7.04137.03	4.7.04137.03	Patch available	CNA
Microsoft	Microsoft .NET Framework 3.5 AND 4.8	4.8.0 to before 4.8.04798.02	4.8.04798.02	Patch available	CNA
Microsoft	Microsoft .NET Framework 3.5 AND 4.8.1	4.8.1 to before 4.8.1.09320.02	4.8.1.09320.02	Patch available	CNA
Microsoft	Microsoft .NET Framework 3.5.1	3.5.0 to before 2.0.50727.8981	2.0.50727.8981	Patch available	CNA
Microsoft	Microsoft .NET Framework 4.6.2	4.7.0 to before 4.7.04137.03	4.7.04137.03	Patch available	CNA
Microsoft	Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2	4.7.0 to before 4.7.04137.03	4.7.04137.03	Patch available	CNA
Microsoft	Microsoft .NET Framework 4.8	4.8.0 to before 4.8.04798.02	4.8.04798.02	Patch available	CNA
Microsoft	Microsoft Visual Studio 2022 version 17.10	17.10.0 to before 17.10.20	17.10.20	Patch available	CNA
Microsoft	Microsoft Visual Studio 2022 version 17.12	17.12.0 to before 17.12.13	17.12.13	Patch available	CNA
Microsoft	Microsoft Visual Studio 2022 version 17.14	17.14.0 to before 17.14.17	17.14.17	Patch available	CNA
—	Microsoft.NetCore.App.Runtime.linux-arm (NuGet)	9.0.0 to before 9.0.10	9.0.10	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet)	9.0.0 to before 9.0.10	9.0.10	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet)	9.0.0 to before 9.0.10	9.0.10	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet)	9.0.0 to before 9.0.10	9.0.10	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet)	9.0.0 to before 9.0.10	9.0.10	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.linux-x64 (NuGet)	9.0.0 to before 9.0.10	9.0.10	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet)	9.0.0 to before 9.0.10	9.0.10	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.osx-x64 (NuGet)	9.0.0 to before 9.0.10	9.0.10	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.win-arm (NuGet)	9.0.0 to before 9.0.10	9.0.10	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.win-arm64 (NuGet)	9.0.0 to before 9.0.10	9.0.10	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.win-x64 (NuGet)	9.0.0 to before 9.0.10	9.0.10	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.win-x86 (NuGet)	9.0.0 to before 9.0.10	9.0.10	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.linux-arm (NuGet)	8.0.0 to before 8.0.21	8.0.21	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet)	8.0.0 to before 8.0.21	8.0.21	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet)	8.0.0 to before 8.0.21	8.0.21	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet)	8.0.0 to before 8.0.21	8.0.21	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet)	8.0.0 to before 8.0.21	8.0.21	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.linux-x64 (NuGet)	8.0.0 to before 8.0.21	8.0.21	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet)	8.0.0 to before 8.0.21	8.0.21	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.osx-x64 (NuGet)	8.0.0 to before 8.0.21	8.0.21	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.win-arm (NuGet)	8.0.0 to before 8.0.21	8.0.21	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.win-arm64 (NuGet)	8.0.0 to before 8.0.21	8.0.21	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.win-x64 (NuGet)	8.0.0 to before 8.0.21	8.0.21	Patch available	GHSA-gwq6-fmvp-qp68
—	Microsoft.NetCore.App.Runtime.win-x86 (NuGet)	8.0.0 to before 8.0.21	8.0.21	Patch available	GHSA-gwq6-fmvp-qp68

.NET 8.0 VendorMicrosoft Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available CNA
.NET 9.0 VendorMicrosoft Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available CNA
Microsoft .NET Framework 2.0 Service Pack 2 VendorMicrosoft Affected 2.0.0 to before 2.0.50727.8981 Fixed in 2.0.50727.8981 Patch available CNA
Microsoft .NET Framework 3.0 Service Pack 2 VendorMicrosoft Affected 3.0.0 to before 2.0.50727.8981 Fixed in 2.0.50727.8981 Patch available CNA
Microsoft .NET Framework 3.5 VendorMicrosoft Affected 3.5.0 to before 2.0.50727.8981 Fixed in 2.0.50727.8981 Patch available CNA
Microsoft .NET Framework 3.5 AND 4.7.2 VendorMicrosoft Affected 4.7.0 to before 4.7.04137.03 Fixed in 4.7.04137.03 Patch available CNA
Microsoft .NET Framework 3.5 AND 4.8 VendorMicrosoft Affected 4.8.0 to before 4.8.04798.02 Fixed in 4.8.04798.02 Patch available CNA
Microsoft .NET Framework 3.5 AND 4.8.1 VendorMicrosoft Affected 4.8.1 to before 4.8.1.09320.02 Fixed in 4.8.1.09320.02 Patch available CNA
Microsoft .NET Framework 3.5.1 VendorMicrosoft Affected 3.5.0 to before 2.0.50727.8981 Fixed in 2.0.50727.8981 Patch available CNA
Microsoft .NET Framework 4.6.2 VendorMicrosoft Affected 4.7.0 to before 4.7.04137.03 Fixed in 4.7.04137.03 Patch available CNA
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 VendorMicrosoft Affected 4.7.0 to before 4.7.04137.03 Fixed in 4.7.04137.03 Patch available CNA
Microsoft .NET Framework 4.8 VendorMicrosoft Affected 4.8.0 to before 4.8.04798.02 Fixed in 4.8.04798.02 Patch available CNA
Microsoft Visual Studio 2022 version 17.10 VendorMicrosoft Affected 17.10.0 to before 17.10.20 Fixed in 17.10.20 Patch available CNA
Microsoft Visual Studio 2022 version 17.12 VendorMicrosoft Affected 17.12.0 to before 17.12.13 Fixed in 17.12.13 Patch available CNA
Microsoft Visual Studio 2022 version 17.14 VendorMicrosoft Affected 17.14.0 to before 17.14.17 Fixed in 17.14.17 Patch available CNA
Microsoft.NetCore.App.Runtime.linux-arm (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.linux-x64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.osx-x64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.win-arm (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.win-arm64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.win-x64 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.win-x86 (NuGet) Vendor— Affected 9.0.0 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.linux-arm (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.linux-x64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.osx-x64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.win-arm (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.win-arm64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.win-x64 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-gwq6-fmvp-qp68
Microsoft.NetCore.App.Runtime.win-x86 (NuGet) Vendor— Affected 8.0.0 to before 8.0.21 Fixed in 8.0.21 Patch available GHSA-gwq6-fmvp-qp68

CPE configurations NVD · 33

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:.net_framework:4.6.2:::::::*	4.6.2	Vulnerable	Microsoft
cpe:2.3:a:microsoft:.net_framework:4.7:::::::*	4.7	Vulnerable	Microsoft
cpe:2.3:a:microsoft:.net_framework:4.7.1:::::::*	4.7.1	Vulnerable	Microsoft
cpe:2.3:a:microsoft:.net_framework:4.7.2:::::::*	4.7.2	Vulnerable	Microsoft
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:*	r2 sp1	Running on	Microsoft
cpe:2.3:o:microsoft:windows_server_2012:-:::::::*	not specified by NVD	Running on	Microsoft
cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*	r2	Running on	Microsoft
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x64:*	not specified by NVD	Running on	Microsoft
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x86:*	not specified by NVD	Running on	Microsoft
cpe:2.3:a:microsoft:.net_framework:3.5.1:::::::*	3.5.1	Vulnerable	Microsoft

cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* Versions 4.6.2 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* Versions 4.7.1 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* Versions 4.7.2 Vulnerable ·Microsoft
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* Versions r2 sp1 Running on ·Microsoft
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:* Versions 3.5.1 Vulnerable ·Microsoft

Show 23 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:.net_framework:3.5:-::::::	3.5	Vulnerable	Microsoft
cpe:2.3:a:microsoft:.net_framework:4.8.1:::::::*	4.8.1	Vulnerable	Microsoft
cpe:2.3:o:microsoft:windows_10_21h2::::::::	all versions	Running on	Microsoft
cpe:2.3:o:microsoft:windows_10_22h2::::::::	all versions	Running on	Microsoft
cpe:2.3:o:microsoft:windows_11_22h2::::::::	all versions	Running on	Microsoft
cpe:2.3:o:microsoft:windows_11_23h2::::::::	all versions	Running on	Microsoft
cpe:2.3:o:microsoft:windows_11_24h2::::::::	all versions	Running on	Microsoft
cpe:2.3:o:microsoft:windows_11_25h2::::::::	all versions	Running on	Microsoft
cpe:2.3:o:microsoft:windows_server_2022::::::::	all versions	Running on	Microsoft
cpe:2.3:o:microsoft:windows_server_2022_23h2::::::::	all versions	Running on	Microsoft
cpe:2.3:a:microsoft:.net_framework:4.8:::::::*	4.8	Vulnerable	Microsoft
cpe:2.3:o:microsoft:windows_10_1809:::::::x64:*	all versions	Running on	Microsoft
cpe:2.3:o:microsoft:windows_10_1809:::::::x86:*	all versions	Running on	Microsoft
cpe:2.3:o:microsoft:windows_server_2019::::::::	all versions	Running on	Microsoft
cpe:2.3:o:microsoft:windows_10_1607:::::::x64:*	all versions	Running on	Microsoft
cpe:2.3:o:microsoft:windows_10_1607:::::::x86:*	all versions	Running on	Microsoft
cpe:2.3:o:microsoft:windows_server_2016::::::::	all versions	Running on	Microsoft
cpe:2.3:a:microsoft:.net_framework:3.0:sp2::::::	3.0 sp2	Vulnerable	Microsoft
cpe:2.3:a:microsoft:.net::::::::	8.0.0 to before 8.0.21; 9.0.0 to before 9.0.10	Vulnerable	Microsoft
cpe:2.3:o:apple:macos:-:::::::*	not specified by NVD	Running on	Apple
cpe:2.3:o:linux:linux_kernel:-:::::::*	not specified by NVD	Running on	Linux
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft
cpe:2.3:a:microsoft:visual_studio_2022::::::::	17.10.0 to before 17.10.20; 17.12.0 to before 17.12.13; 17.14.0 to before 17.14.17	Vulnerable	Microsoft

cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:* Versions 3.5 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:* Versions 4.8.1 Vulnerable ·Microsoft
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:* Versions 4.8 Vulnerable ·Microsoft
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* Versions all versions Running on ·Microsoft
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* Versions all versions Running on ·Microsoft
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* Versions all versions Running on ·Microsoft
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* Versions all versions Running on ·Microsoft
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:* Versions 3.0 sp2 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.0.21; 9.0.0 to before 9.0.10 Vulnerable ·Microsoft
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* Versions 17.10.0 to before 17.10.20; 17.12.0 to before 17.12.13; 17.14.0 to before 17.14.17 Vulnerable ·Microsoft

Remediation

Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.linux-arm (NuGet) Fixed in 9.0.10 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) Fixed in 9.0.10 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) Fixed in 9.0.10 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet) Fixed in 9.0.10 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet) Fixed in 9.0.10 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.linux-x64 (NuGet) Fixed in 9.0.10 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet) Fixed in 9.0.10 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.osx-x64 (NuGet) Fixed in 9.0.10 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.win-arm (NuGet) Fixed in 9.0.10 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.win-arm64 (NuGet) Fixed in 9.0.10 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.win-x64 (NuGet) Fixed in 9.0.10 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.win-x86 (NuGet) Fixed in 9.0.10 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.linux-arm (NuGet) Fixed in 8.0.21 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) Fixed in 8.0.21 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) Fixed in 8.0.21 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet) Fixed in 8.0.21 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet) Fixed in 8.0.21 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.linux-x64 (NuGet) Fixed in 8.0.21 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet) Fixed in 8.0.21 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.osx-x64 (NuGet) Fixed in 8.0.21 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.win-arm (NuGet) Fixed in 8.0.21 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.win-arm64 (NuGet) Fixed in 8.0.21 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.win-x64 (NuGet) Fixed in 8.0.21 Advisory →
Fix · GHSA-gwq6-fmvp-qp68 Microsoft.NetCore.App.Runtime.win-x86 (NuGet) Fixed in 8.0.21 Advisory →

Red Hat 10 advisories

RHSA-2026:9205 Released 2026-04-21 · Red Hat rating Important
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images dotnet9.0-9.0.116-1.hum1@src
RHSA-2026:9080 Released 2026-04-20 · Red Hat rating Important
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images dotnet8.0-8.0.126-1.hum1@src
RHSA-2025:23225 Released 2025-12-15 · Red Hat rating Critical
Red Hat OpenShift Dev Spaces 3.25.0 Release.
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.25 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/openvsx-rhel9, registry.redhat.io/devspaces/pluginregistry-rhel9 +3

Show 7 more Red Hat advisories

RHSA-2025:18256 Released 2025-10-16 · Red Hat rating Important
.NET 8.0 security update
- Red Hat CodeReady Linux Builder EUS (v.9.4) dotnet-sdk-8.0-source-built-artifacts-8.0.121-1.el9_4
- Red Hat Enterprise Linux AppStream EUS (v.9.4) aspnetcore-runtime-8.0-8.0.21-1.el9_4, aspnetcore-runtime-dbg-8.0-8.0.21-1.el9_4, aspnetcore-targeting-pack-8.0-8.0.21-1.el9_4 +11
RHSA-2025:18151 Released 2025-10-15 · Red Hat rating Important
.NET 9.0 security update
- Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-9.0-9.0.10-1.el9_6, aspnetcore-runtime-dbg-9.0-9.0.10-1.el9_6, aspnetcore-targeting-pack-9.0-9.0.10-1.el9_6 +12
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-9.0-source-built-artifacts-9.0.111-1.el9_6
RHSA-2025:18150 Released 2025-10-15 · Red Hat rating Important
.NET 9.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-9.0-9.0.10-1.el8_10, aspnetcore-runtime-dbg-9.0-9.0.10-1.el8_10, aspnetcore-targeting-pack-9.0-9.0.10-1.el8_10 +13
- Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-9.0-source-built-artifacts-9.0.111-1.el8_10
RHSA-2025:18153 Released 2025-10-15 · Red Hat rating Important
.NET 9.0 security update
- Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-9.0-9.0.10-1.el10_0, aspnetcore-runtime-dbg-9.0-9.0.10-1.el10_0, aspnetcore-targeting-pack-9.0-9.0.10-1.el10_0 +12
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-9.0-source-built-artifacts-9.0.111-1.el10_0
RHSA-2025:18152 Released 2025-10-15 · Red Hat rating Important
.NET 8.0 security update
- Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-8.0-8.0.21-1.el10_0, aspnetcore-runtime-dbg-8.0-8.0.21-1.el10_0, aspnetcore-targeting-pack-8.0-8.0.21-1.el10_0 +9
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-8.0-source-built-artifacts-8.0.121-1.el10_0
RHSA-2025:18149 Released 2025-10-15 · Red Hat rating Important
.NET 8.0 security update
- Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-8.0-8.0.21-1.el9_6, aspnetcore-runtime-dbg-8.0-8.0.21-1.el9_6, aspnetcore-targeting-pack-8.0-8.0.21-1.el9_6 +9
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-8.0-source-built-artifacts-8.0.121-1.el9_6
RHSA-2025:18148 Released 2025-10-15 · Red Hat rating Important
.NET 8.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-8.0-8.0.21-1.el8_10, aspnetcore-runtime-dbg-8.0-8.0.21-1.el8_10, aspnetcore-targeting-pack-8.0-8.0.21-1.el8_10 +9
- Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-8.0-source-built-artifacts-8.0.121-1.el8_10

Microsoft 16 updates

KB5068332
Security Update
- .NET 9.0 installed on Linux 9.0.10
- .NET 9.0 installed on Mac OS 9.0.10
- .NET 9.0 installed on Windows 9.0.10
- ASP.NET Core 9.0 9.0.10
KB5068331
Security Update
- .NET 8.0 installed on Linux 8.0.21
- .NET 8.0 installed on Mac OS 8.0.21
- .NET 8.0 installed on Windows 8.0.21
- ASP.NET Core 8.0 8.0.21
KB5066836
Security Update
- Microsoft .NET Framework 3.5 AND 4.7.2 10.0.14393.8519
- Windows 10 Version 1607 for 32-bit Systems 10.0.14393.8519
- Windows 10 Version 1607 for x64-based Systems 10.0.14393.8519
- Windows Server 2016 10.0.14393.8519
- Windows Server 2016 (Server Core installation) 10.0.14393.8519

Show 13 more Microsoft updates

KB5066747
Security Update
- Microsoft .NET Framework 3.5 AND 4.8 4.8.04798.04
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1.09320.02
KB5066746
Security Update
- Microsoft .NET Framework 3.5 AND 4.8 4.8.04798.04
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1.09320.02
KB5066743
Security Update
- Microsoft .NET Framework 3.5 AND 4.8 4.8.04798.04
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1.09320.02
KB5066742
Monthly Rollup
- Microsoft .NET Framework 2.0 Service Pack 2 2.0.50727.8981
- Microsoft .NET Framework 3.0 Service Pack 2 2.0.50727.8981
- Microsoft .NET Framework 3.5 2.0.50727.8981
- Microsoft .NET Framework 4.6.2 4.7.04137.03
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.04137.03
KB5066741
Monthly Rollup
- Microsoft .NET Framework 3.5 2.0.50727.8981
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.04137.03
- Microsoft .NET Framework 4.8 4.8.04798.04
KB5066740
Monthly Rollup
- Microsoft .NET Framework 3.5 2.0.50727.8981
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.04137.06
- Microsoft .NET Framework 4.8 4.8.04798.04
KB5066739
Monthly Rollup
- Microsoft .NET Framework 3.5.1 2.0.50727.8981
- Microsoft .NET Framework 4.8 4.8.04798.02
KB5066738
Security Update
- Microsoft .NET Framework 3.5 AND 4.7.2 4.7.04137.03
- Microsoft .NET Framework 3.5 AND 4.8 4.8.04798.02
KB5066136
Security Update
- Microsoft .NET Framework 4.8 4.8.04798.02
KB5066133
Security Update
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1.09321.01
KB5066131
Security Update
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1.09321.01
KB5066129
Security Update
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1.09321.01
KB5066128
Security Update
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1.09321.01

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 9	Affected	No fix planned: Out of support scope
Red Hat CodeReady Linux Builder EUS (v.9.4)	Fixed	RHSA-2025:18256
Red Hat Enterprise Linux AppStream (v. 10)	Fixed	RHSA-2025:18152, RHSA-2025:18153
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2025:18148, RHSA-2025:18150
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2025:18149, RHSA-2025:18151
Red Hat Enterprise Linux AppStream EUS (v.9.4)	Fixed	RHSA-2025:18256
Red Hat Enterprise Linux CRB (v. 8)	Fixed	RHSA-2025:18148, RHSA-2025:18150
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)	Fixed	RHSA-2025:18152, RHSA-2025:18153
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)	Fixed	RHSA-2025:18149, RHSA-2025:18151
Red Hat Hardened Images	Fixed	RHSA-2026:9080, RHSA-2026:9205
Red Hat OpenShift Dev Spaces (RHOSDS) 3.25	Fixed	RHSA-2025:23225

Not affected: 4 products

Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9
Red Hat Hardened Images
Red Hat OpenShift Dev Spaces (RHOSDS) 3.25

Microsoft

Microsoft's page for this CVE →

Impact: Information Disclosure
Exploited: No
Publicly disclosed: No
Exploitability: Exploitation Less Likely

Product	Status	Plan or fix
Microsoft Visual Studio 2022 version 17.10	Fixed	17.10.20 · Security Update
Microsoft Visual Studio 2022 version 17.12	Fixed	17.12.13 · Security Update
Microsoft Visual Studio 2022 version 17.14	Fixed	17.14.17 · Security Update

Timeline

2026-10-02 Threatist record created from CVE-2025-55248
2026-10-03 Alias added: GHSA-gwq6-fmvp-qp68

References

Patch 1

.NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability

Other 4

TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
TI-2023-19588 Microsoft QUIC Denial of Service Vulnerability CVSS 3.1HIGH 7.5
TI-2024-14152 .NET and Visual Studio Denial of Service Vulnerability CVSS 3.1HIGH 7.5
TI-2021-08380 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8

See all 129 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences