.NET 6.0 vulnerabilities

4 known vulnerabilities in .NET 6.0 from Microsoft. 4 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  .NET 6.0: Buffer Over-read

  CVE-2025-36855Sep 8, 2025Microsoft

  A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read. Per CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using bu

• 8.1 High severity

  .NET 6.0: Use After Free

  CVE-2025-36854Sep 8, 2025Microsoft

  A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free, resulting in Remote Code Execution. Per CW

• 7.5 High severity

  .NET 6.0: Heap-based Buffer Overflow

  CVE-2025-36853Sep 8, 2025Microsoft

  A vulnerability (CVE-2025-21172) exists in msdia140.dll due to integer overflow and heap-based overflow. Per CWE-122: Heap-based Buffer Overflow, a heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap

• 7.5 High severity

  Microsoft .NET Core and Visual Studio Denial-of-Service Exploited

  CVE-2023-38180Aug 8, 2023MicrosoftEPSS 14.1%

  .NET and Visual Studio Denial of Service Vulnerability