CVE-2025-36855

highpriority · track · 0EPSS 0.008 · 55 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.77% (55th) EPSS

CVSS 8.8 · high

Is it mine?

21 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-26

A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read. Per CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.11 & <= 9.0.0 as represented in CVE-2025-21176. Additionally, if you've deployed self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondaryexploitability 2.8 · impact 5.9

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-126USCWE-126US

affected products (21)

Products and version ranges known to be affected.

Microsoft .NET 6.06.0.0 → 6.0.36enisa_euvdEU
Microsoft Corp .NET≤ 8.0fstec_bduRU
Microsoft Corp .NET≤ 9.0fstec_bduRU
Microsoft Corp Microsoft .NET Framework 3.5all versionsfstec_bduRU
Microsoft Corp Microsoft .NET Framework 4.6all versionsfstec_bduRU
Microsoft Corp Microsoft .NET Framework 4.6.2all versionsfstec_bduRU
Microsoft Corp Microsoft .NET Framework 4.7all versionsfstec_bduRU
Microsoft Corp Microsoft .NET Framework 4.7.1all versionsfstec_bduRU
Microsoft Corp Microsoft .NET Framework 4.7.2all versionsfstec_bduRU
Microsoft Corp Microsoft .NET Framework 4.8all versionsfstec_bduRU
Microsoft Corp Microsoft .NET Framework 4.8.1all versionsfstec_bduRU
Microsoft Corp Microsoft Visual Studio 2015 Update 3all versionsfstec_bduRU
Microsoft Corp Microsoft Visual Studio 201715.0 → 15.9fstec_bduRU
Microsoft Corp Microsoft Visual Studio 201916.0 → 16.10fstec_bduRU
Microsoft Corp Microsoft Visual Studio 2022≤ 17.12fstec_bduRU
Microsoft Corp Microsoft Visual Studio 2022≤ 17.6fstec_bduRU
Microsoft Corp Microsoft Visual Studio 2022≤ 17.8fstec_bduRU
Microsoft Corp Microsoft Visual Studio 2022≤ 17.10fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
Bitnami dotnet6.0.0 → 6.0.36osvUSpkg:bitnami/dotnet

showing 20 of 21

advisories (2)

Vendor and ecosystem advisories describing this.

BIT-dotnet-2025-36855EOL .NET 6.0 Runtime Remote Code Execution Vulnerability2026-09-18vendor · osvUS
A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read. Per CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.11 & <= 9.0.0 as represented in CVE-2025-21176. Additionally, if you've deployed self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
BIT-dotnet-sdk-2025-36855EOL .NET 6.0 Runtime Remote Code Execution Vulnerability2026-09-18vendor · osvUS
A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read. Per CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.11 & <= 9.0.0 as represented in CVE-2025-21176. Additionally, if you've deployed self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv NVD CVE.org MITRE

published 2025-09-08modified 2026-06-17

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan