CVE-2025-30399

Name
CVE-2025-30399
Description
Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
vendor-advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30399

Match rules

CPE URI Source package Min version Max version
.net-8.0 >= 8.0.0 < 8.0.17
.net-9.0 >= 9.0.0 < 9.0.6
microsoft-visual-studio-2022-version-17.12 >= 17.12.0 < 17.12.9
microsoft-visual-studio-2022-version-17.8 >= 17.8.0 < 17.8.22
microsoft-visual-studio-2022-version-17.10 >= 17.10.0 < 17.10.16
microsoft-visual-studio-2022-version-17.14 >= 17.14.0 < 17.14.5
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* visual_studio_2022 >= 17.8.0 < 17.8.22
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* visual_studio_2022 >= 17.10.0 < 17.10.16
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* visual_studio_2022 >= 17.12.0 < 17.12.9
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* visual_studio_2022 >= 17.14.0 < 17.14.5

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
dotnet9-runtime edge-community 9.0.6-r0 Antoine Martin (ayakael) <dev@ayakael.net> fixed
dotnet9-runtime 3.22-community 9.0.6-r0 None fixed
dotnet8-runtime edge-community 8.0.17-r0 Antoine Martin (ayakael) <dev@ayakael.net> fixed
dotnet8-runtime 3.22-community 8.0.17-r0 None fixed