CVE-2025-21173: .NET Elevation of Privilege Vulnerability
Vulnerability summary
CVE-2025-21173 is a high (CVSS 7.3) vulnerability in microsoft microsoft visual studio 2022 version 17.10. EPSS estimates a 1.30% chance of exploitation in the next 30 days, higher than 70.4% of scored vulnerabilities.
Not severe (CVSS 7.3, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 2Timeline
- 14-01-2025PublishedVulnerability first disclosed.
- 09-06-2026Last modifiedVulnerability information updated.
Description
.NET Elevation of Privilege Vulnerability
CVSS metrics
6 scores · 6 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- NVDNIST7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · AlpineEcosystem advisory · calculated7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.30%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
Increase +0.05 pp
From 1.24% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Microsoft8 products
- microsoft visual studio 2022 version 17.10≥ 17.10.0, < 17.10.10
- microsoft visual studio 2022 version 17.12≥ 17.12.0, < 17.12.4
- microsoft visual studio 2022 version 17.6≥ 17.6.0, < 17.6.22
- microsoft visual studio 2022 version 17.8≥ 17.8.0, < 17.8.17
- .net8.0.0 | 9.0.0
Ubuntu3 products
- dotnet6All versions (No fix recorded)
- dotnet7All versions (No fix recorded)
- dotnet8< 8.0.112-8.0.12-0ubuntu1~22.04.1 | < 8.0.112-8.0.12-0ubuntu1~24.04.1
Alpine2 products
- dotnet8-runtime< 8.0.12-r0
- dotnet9-runtime< 9.0.1-r0
Chainguard1 product
- dotnet-bootstrap-9< 9.0.200-r0
Wolfi1 product
- dotnet-bootstrap-9< 9.0.200-r0
5 vendors · 15 products
