Information Disclosure Vulnerability in .NET Framework and Visual Studio by Microsoft
CVE-2025-55248

4.8MEDIUM

Key Information:

Vendor

Microsoft
Status
.net 8.0
.net 9.0
Microsoft Visual Studio 2022 Version 17.12
Microsoft Visual Studio 2022 Version 17.10
Vendor
CVE Published:
14 October 2025

What is CVE-2025-55248?

This vulnerability arises from inadequate encryption strength within .NET, .NET Framework, and Visual Studio. An authorized attacker could exploit this weakness to intercept and disclose sensitive information transmitted over a network, compromising data integrity and privacy. It's essential for users and organizations utilizing these products to be aware of this issue and apply necessary mitigations to safeguard their data.

Affected Version(s)

.NET 8.0 Unknown 8.0.0 < 8.0.21

.NET 9.0 Unknown 9.0.0 < 9.0.10

Microsoft .NET Framework 2.0 Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 2.0.0 < 2.0.50727.8981

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-55248 : Information Disclosure Vulnerability in .NET Framework and Visual Studio by Microsoft