CVE-2025-21172

CVE-2025-21172 is a Remote Code Execution vulnerability affecting .NET and Visual Studio. Published on 2025-01-14, it is associated with CWE-122 (Heap-based Buffer Overflow), CWE-190 (Integer Overflow or Wraparound), and NVD-CWE-noinfo. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

An unauthenticated attacker can exploit this vulnerability over the network, though successful attacks require high complexity and user interaction, such as a victim opening a malicious file or interacting with crafted content. Exploitation enables remote code execution, granting high-impact access to confidentiality, integrity, and availability within the scope of the affected process.

Microsoft's Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21172 provides details on patches and mitigation steps, with additional information available at https://www.herodevs.com/vulnerability-directory/cve-2025-21172.