CVE-2025-36855 json
EOL .NET 6.0 Runtime Remote Code Execution Vulnerability
published 2025-09-08 14 mo ago modified 2026-09-18 52 d ago also BIT-dotnet-2025-36855 , BIT-dotnet-sdk-2025-36855 , EUVD-2025-27125
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read.
Per CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.11 & <= 9.0.0 as represented in CVE-2025-21176.
Additionally, if you've deployed self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.
NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
Patch / fix
- bitnami dotnet 6.0.36
- bitnami dotnet-sdk 6.0.36
- Microsoft .NET 6.0 6.0.36
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 14 mo ago
Exploit prediction
0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | dotnet | >=6.0.0, <6.0.36 |
6.0.36 |
| bitnami | dotnet-sdk | >=6.0.0, <6.0.36 |
6.0.36 |
Affected products
- Microsoft .NET 6.0
Classification
- Weakness
-
- CWE-126 Buffer Over-read
References
-
msrc.microsoft.com
/update-guide/vulnerability/CVE-2025-21176
vendor-advisory, web
-
herodevs.com
/vulnerability-directory/cve-2025-21176
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2025-36855
web
Sources
- CVE List CVE-2025-36855
- NVD CVE-2025-36855
- OSV BIT-dotnet-2025-36855
- OSV BIT-dotnet-sdk-2025-36855
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.