CVE-2025-36855: EOL .NET 6.0 Runtime Remote Code Execution Vulnerability
A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read.
Per CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.11 & <= 9.0.0 as represented in CVE-2025-21176.
Additionally, if you've deployed self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.
NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-36855?
CVE-2025-36855 is classified as a medium severity vulnerability due to the potential for exploitation through a buffer over-read.
How do I fix CVE-2025-36855?
To fix CVE-2025-36855, update your Microsoft .NET installation to version 6.0.36 or above, or to version 8.0.11 and above.
Which software versions are affected by CVE-2025-36855?
CVE-2025-36855 affects Microsoft .NET versions between 6.0.0 and 6.0.36, versions between 8.0.0 and 8.0.11, and all versions up to 9.0.0.
What type of vulnerability is CVE-2025-36855?
CVE-2025-36855 is a buffer over-read vulnerability that can potentially lead to information disclosure.
Is CVE-2025-36855 exploitable remotely?
Yes, CVE-2025-36855 can be exploited remotely if an attacker can interact with the vulnerable DiSymReader.dll component.