CVE-2025-55247

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-w3q9-fxm7-j8fq. This link is maintained to preserve external references.

Original Description

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

Microsoft Security Advisory CVE-2025-55247 | .NET Denial of Service Vulnerability

<a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0.xxx, .NET 9.0.xxx and .NET 10.0.xxx. This advisory also provides guidance on what developers can do to update their environments to remove this vulnerability.

A vulnerability exists in .NET where predictable paths for MSBuild's temporary directories on Linux let another user create the directories ahead of MSBuild, leading to DoS of builds. This only affects .NET on Linux operating systems.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/370

<a name="mitigation-factors"></a>Mitigation factors

Projects which do not utilize the DownloadFile build task are not susceptible to this vulnerability.

<a name="affected-software"></a>Affected software

• Any installation of .NET 10.0.100-rc.1.25451.107 SDK or earlier.
• Any installation of .NET 9.0.110 SDK, .NET 9.0.305 SDK or earlier.
• Any installation of .NET 8.0.120 SDK, .NET 8.0.317 SDK, .NET 8.0.414 SDK or earlier.

<a name="affected-packages"></a>Affected Packages

The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below

Package name |Affected version | Patched version ------------ |---------------- | ------------------------- Microsoft.Build.Tasks.Core | 17.15.0-preview-25277-114 <br />>=17.14.0, <= 17.14.8 <br />>= 17.12.0, <= 17.12.36 <br/> >= 17.11.0, <= 17.11.31<br /> >= 17.10.0, <= 17.10.29 <br /> >= 17.8.0, <= 17.8.29 <br /> | 18.0.0-preview-25476-107 <br />17.14.28 <br />17.12.50 <br/>17.11.48 <br />17.10.46 <br />17.8.43 <br />

Package name|Affected version | Patched version ------------ |---------------|---------------- Microsoft.Build | 17.15.0-preview-25277-114 <br />>=17.14.0, <= 17.14.8 <br />>= 17.12.0, <= 17.12.36 <br/> >= 17.11.0, <= 17.11.31<br /> >= 17.10.0, <= 17.10.29 <br /> >= 17.8.0, <= 17.8.29 <br /> | 18.0.0-preview-25476-107 <br />17.14.28 <br />17.12.50 <br/>17.11.48 <br />17.10.46 <br />17.8.43 <br />

Package name |Affected version | Patched version ------------ |---------------|---------------- Microsoft.Build.Utilities.core| 17.15.0-preview-25277-114 <br />>=17.14.0, <= 17.14.8 <br />>= 17.12.0, <= 17.12.36 <br/> >= 17.11.0, <= 17.11.31<br /> >= 17.10.0, <= 17.10.29 <br /> >= 17.8.0, <= 17.8.29 <br /> | 18.0.0-preview-25476-107 <br />17.14.28 <br />17.12.50 <br/>17.11.48 <br />17.10.46 <br />17.8.43 <br />

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

If you have a .NET SDK with a version listed, or an affected package listed in affected software or affected packages, you're exposed to the vulnerability.

<a name="how-fix"></a>How do I fix the issue?

1. To fix the issue please install the latest version of .NET 10.0 SDK, .NET 9.0 SDK or .NET 8.0 SDK. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.
2. If your application references the vulnerable package, update the package reference to the patched version.

• You can list the versions you have installed by running the dotnet --info command. You will see output like the following;

.NET SDK:
 Version:           9.0.100
 Commit:            59db016f11
 Workload version:  9.0.100-manifests.3068a692
 MSBuild version:   17.12.7+5b8665660

Runtime Environment:
 OS Name:     Mac OS X
 OS Version:  15.2
 OS Platform: Darwin
 RID:         osx-arm64
 Base Path: …

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2025-55247 in the Microsoft.Build.Utilities.Core package for Root:NuGet. Multiple fixed versions available.

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):

• dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
• dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
• dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

It was discovered that .NET did not properly handle the creation of temporary build time directories. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-55247)

It was discovered that .NET did not properly establish TLS sessions for SMTP server connections. An attacker could use this issue to cause .NET to use unencrypted connections. This issue only affects .NET versions 8.0 and 9.0. (CVE-2025-55248)

It was discovered that .NET inconsistently interpreted certain http requests. An attacker could possibly use this to bypass a security feature over a network. (CVE-2025-55315)