CVE-2025-30399

Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.

Published: Jun 11, 2025
Updated: Aug 11, 2025
CVE: CVE-2025-30399
GHSA: GHSA-266m-wp2v-x7mq
Severity: High
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWEs:

CWE-426

Affected Software
References

Software	From	Fixed in
Microsoft.NETCore.App.Runtime.linux-arm	9.0.0	9.0.6
Microsoft.NETCore.App.Runtime.linux-arm64	9.0.0	9.0.6
Microsoft.NETCore.App.Runtime.linux-musl-arm	9.0.0	9.0.6
Microsoft.NETCore.App.Runtime.linux-musl-arm64	9.0.0	9.0.6
Microsoft.NETCore.App.Runtime.linux-musl-x64	9.0.0	9.0.6
Microsoft.NETCore.App.Runtime.linux-x64	9.0.0	9.0.6
Microsoft.NETCore.App.Runtime.osx-arm64	9.0.0	9.0.6
Microsoft.NETCore.App.Runtime.osx-x64	9.0.0	9.0.6
Microsoft.NETCore.App.Runtime.win-arm	9.0.0	9.0.6
Microsoft.NETCore.App.Runtime.win-arm64	9.0.0	9.0.6
Microsoft.NETCore.App.Runtime.win-x64	9.0.0	9.0.6
Microsoft.NETCore.App.Runtime.win-x86	9.0.0	9.0.6
Microsoft.NETCore.App.Runtime.linux-arm	8.0.0	8.0.17
Microsoft.NETCore.App.Runtime.linux-arm64	8.0.0	8.0.17
Microsoft.NETCore.App.Runtime.linux-musl-arm	8.0.0	8.0.17
Microsoft.NETCore.App.Runtime.linux-musl-arm64	8.0.0	8.0.17
Microsoft.NETCore.App.Runtime.linux-musl-x64	8.0.0	8.0.17
Microsoft.NETCore.App.Runtime.linux-x64	8.0.0	8.0.17
Microsoft.NETCore.App.Runtime.osx-arm64	8.0.0	8.0.17
Microsoft.NETCore.App.Runtime.osx-x64	8.0.0	8.0.17
Microsoft.NETCore.App.Runtime.win-arm	8.0.0	8.0.17
Microsoft.NETCore.App.Runtime.win-arm64	8.0.0	8.0.17
Microsoft.NETCore.App.Runtime.win-x64	8.0.0	8.0.17
Microsoft.NETCore.App.Runtime.win-x86	8.0.0	8.0.17
microsoft / visual_studio_2022	17.10.0	17.10.16
microsoft / visual_studio_2022	17.12.0	17.12.9
microsoft / visual_studio_2022	17.14.0	17.14.5
microsoft / visual_studio_2022	17.8.0	17.8.22
microsoft / .net	9.0.0	9.0.6
microsoft / .net	8.0.0	8.0.17
microsoft / powershell	7.4	7.4.11
microsoft / powershell	7.5	7.5.2

Vulnerability Database

CVE-2025-30399