CVE-2025-36855 — Buffer Over-read in Microsoft NET 6.0

CWE-126 — Buffer Over-read3 documents3 sources
Severity
8.8HIGHNVD
EPSS
0.1%
top 75.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft NET 6.0
Timeline
PublishedSep 8

Description

A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read. Per CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.11 & <= 9.0.0 as represented …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

▶CVEListV5microsoft/net_6.06.0.0 — 6.0.36

🔴Vulnerability Details

2
GHSA
GHSA-642h-ggvv-j2c4: A vulnerability ( CVE-2025-21176 https://www↗2025-09-08
▶
CVEList
EOL .NET 6.0 Runtime Remote Code Execution Vulnerability↗2025-09-08
▶
CVE-2025-36855 — Buffer Over-read in Microsoft NET 6.0 | cvebase