PT-2025-36469 · Microsoft+1 · .Net 6.0.36+6

Published 2025-01-14 · Updated 2025-10-02 · CVE-2025-36855

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: .NET 6.0.0 through 6.0.36 .NET 8.0.0 through 8.0.11 .NET 9.0.0

Description: A buffer over-read issue exists in DiaSymReader.dll. This occurs when a product reads from a buffer using buffer access mechanisms that reference memory locations after the targeted buffer. This affects self-contained applications targeting the impacted versions, which require recompilation and redeployment. The affected software components are End Of Life (EOL) and will not receive further updates or support.

Recommendations: Recompile and redeploy self-contained applications targeting .NET 6.0.0 through 6.0.36. Recompile and redeploy self-contained applications targeting .NET 8.0.0 through 8.0.11. Recompile and redeploy self-contained applications targeting .NET 9.0.0.

Fix

RCE

Buffer Over-read

Weakness Enumeration

CWE-126

Related Identifiers

BDU:2025-12584

CVE-2025-36855

Affected Products

.Net 6.0.0

.Net 6.0.36

.Net 8.0.0

.Net 8.0.11

.Net 9.0.0

Diasymreader.Dll

Red Os

References · 9

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-36855 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12584 · Security Note
• https://t.me/canyoupwnme/6959 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-dotnet-cve-2025-36855-cve-2025-36854-cve-2025-36853 · Note
• https://twitter.com/CVEnew/status/1965056553230160062 · Twitter Post
• https://herodevs.com/vulnerability-directory/cve-2025-21176 · Note
• https://t.me/CVEtracker/31957 · Telegram Post