{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2025-21171 .NET Remote Code Execution Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21171"
      },
      {
        "category": "self",
        "summary": "CVE-2025-21171 .NET Remote Code Execution Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-21171.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": ".NET Remote Code Execution Vulnerability",
    "tracking": {
      "current_release_date": "2025-01-29T08:00:00.000Z",
      "generator": {
        "date": "2025-04-02T13:22:58.300Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2025-21171",
      "initial_release_date": "2025-01-14T08:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-01-14T08:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2025-01-29T08:00:00.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Revised the Security Updates table to include PowerShell 7.5 installed on Windows, PowerShell 7.5 installed on Linux, and PowerShell 7.5 installed on MacOC because these versions of PowerShell 7 are affected by this vulnerability. See [https://github.com/PowerShell/Announcements/issues/72](https://github.com/PowerShell/Announcements/issues/72) for more information."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c7.5.0",
            "product": {
              "name": "PowerShell 7.5 installed on Windows \u003c7.5.0",
              "product_id": "3"
            }
          },
          {
            "category": "product_version",
            "name": "7.5.0",
            "product": {
              "name": "PowerShell 7.5 installed on Windows 7.5.0",
              "product_id": "12476"
            }
          }
        ],
        "category": "product_name",
        "name": "PowerShell 7.5 installed on Windows"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c7.5.0",
            "product": {
              "name": "PowerShell 7.5 installed on Linux \u003c7.5.0",
              "product_id": "2"
            }
          },
          {
            "category": "product_version",
            "name": "7.5.0",
            "product": {
              "name": "PowerShell 7.5 installed on Linux 7.5.0",
              "product_id": "12477"
            }
          }
        ],
        "category": "product_name",
        "name": "PowerShell 7.5 installed on Linux"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c7.5.0",
            "product": {
              "name": "PowerShell 7.5 installed on MacOS \u003c7.5.0",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "7.5.0",
            "product": {
              "name": "PowerShell 7.5 installed on MacOS 7.5.0",
              "product_id": "12478"
            }
          }
        ],
        "category": "product_name",
        "name": "PowerShell 7.5 installed on MacOS"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c9.0.1",
            "product": {
              "name": ".NET 9.0 installed on Linux \u003c9.0.1",
              "product_id": "7"
            }
          },
          {
            "category": "product_version",
            "name": "9.0.1",
            "product": {
              "name": ".NET 9.0 installed on Linux 9.0.1",
              "product_id": "12432"
            }
          }
        ],
        "category": "product_name",
        "name": ".NET 9.0 installed on Linux"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c9.0.1",
            "product": {
              "name": ".NET 9.0 installed on Mac OS \u003c9.0.1",
              "product_id": "6"
            }
          },
          {
            "category": "product_version",
            "name": "9.0.1",
            "product": {
              "name": ".NET 9.0 installed on Mac OS 9.0.1",
              "product_id": "12433"
            }
          }
        ],
        "category": "product_name",
        "name": ".NET 9.0 installed on Mac OS"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c9.0.1",
            "product": {
              "name": ".NET 9.0 installed on Windows \u003c9.0.1",
              "product_id": "5"
            }
          },
          {
            "category": "product_version",
            "name": "9.0.1",
            "product": {
              "name": ".NET 9.0 installed on Windows 9.0.1",
              "product_id": "12434"
            }
          }
        ],
        "category": "product_name",
        "name": ".NET 9.0 installed on Windows"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c17.12.4",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.12 \u003c17.12.4",
              "product_id": "4"
            }
          },
          {
            "category": "product_version",
            "name": "17.12.4",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.12 17.12.4",
              "product_id": "12459"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Visual Studio 2022 version 17.12"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c17.6.22",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.6 \u003c17.6.22",
              "product_id": "10"
            }
          },
          {
            "category": "product_version",
            "name": "17.6.22",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.6 17.6.22",
              "product_id": "12187"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Visual Studio 2022 version 17.6"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c17.8.17",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.8 \u003c17.8.17",
              "product_id": "9"
            }
          },
          {
            "category": "product_version",
            "name": "17.8.17",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.8 17.8.17",
              "product_id": "12271"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Visual Studio 2022 version 17.8"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c17.10.10",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.10 \u003c17.10.10",
              "product_id": "8"
            }
          },
          {
            "category": "product_version",
            "name": "17.10.10",
            "product": {
              "name": "Microsoft Visual Studio 2022 version 17.10 17.10.10",
              "product_id": "12322"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Visual Studio 2022 version 17.10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-21171",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "This attack requires a victim to perform a specific action, such as copying files or executing a command, and for an attacker with appropriate access to have pre-planted malicious files with knowledge of where they should be placed on the victim\u0027s system.",
          "title": "According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution?"
        },
        {
          "category": "faq",
          "text": "This attack requires a victim to perform a specific action, such as copying files or executing a command, and for an attacker with appropriate access to have pre-planted malicious files with knowledge of where they should be placed on the victim\u0027s system.",
          "title": "According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "Exploitation of this vulnerability requires that a user trigger the payload in the application.",
          "title": "According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?"
        }
      ],
      "product_status": {
        "fixed": [
          "12187",
          "12271",
          "12322",
          "12432",
          "12433",
          "12434",
          "12459",
          "12476",
          "12477",
          "12478"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-21171 .NET Remote Code Execution Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21171"
        },
        {
          "category": "self",
          "summary": "CVE-2025-21171 .NET Remote Code Execution Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-21171.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-14T08:00:00.000Z",
          "details": "7.5.0:Security Update:https://github.com/PowerShell/Announcements/issues/72",
          "product_ids": [
            "3",
            "2",
            "1"
          ],
          "url": "https://github.com/PowerShell/Announcements/issues/72"
        },
        {
          "category": "vendor_fix",
          "date": "2025-01-14T08:00:00.000Z",
          "details": "9.0.1:Security Update:https://support.microsoft.com/help/5050526",
          "product_ids": [
            "7",
            "6",
            "5"
          ],
          "url": "https://support.microsoft.com/help/5050526"
        },
        {
          "category": "vendor_fix",
          "date": "2025-01-14T08:00:00.000Z",
          "details": "17.12.4:Security Update:https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes",
          "product_ids": [
            "4"
          ],
          "url": "https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes"
        },
        {
          "category": "vendor_fix",
          "date": "2025-01-14T08:00:00.000Z",
          "details": "17.6.22:Security Update:https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes",
          "product_ids": [
            "10"
          ],
          "url": "https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes"
        },
        {
          "category": "vendor_fix",
          "date": "2025-01-14T08:00:00.000Z",
          "details": "17.8.17:Security Update:https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes",
          "product_ids": [
            "9"
          ],
          "url": "https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes"
        },
        {
          "category": "vendor_fix",
          "date": "2025-01-14T08:00:00.000Z",
          "details": "17.10.10:Security Update:https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes",
          "product_ids": [
            "8"
          ],
          "url": "https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Remote Code Execution"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely"
        }
      ],
      "title": ".NET Remote Code Execution Vulnerability"
    }
  ]
}