CVE-2025-24043

Published Mar 11, 2025

Last updated 24 days ago

CVSS high 7.5

Microsoft

WinDbg

.NET

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-24043 is a remote code execution (RCE) vulnerability in Microsoft's WinDbg debugging tool and associated .NET packages. The flaw exists due to improper cryptographic signature verification within the SOS debugging extension. This allows an attacker with network access to execute arbitrary code on affected systems. .NET Core projects using vulnerable versions of the `dotnet-sos`, `dotnet-dump`, and `dotnet-debugger-extensions` NuGet packages are susceptible. Microsoft recommends updating to the latest versions of these packages and WinDbg itself to mitigate the vulnerability.

Description: Improper verification of cryptographic signature in .NET allows an authorized attacker to execute code over a network.
Source: secure@microsoft.com
NVD status: Received

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 5.9
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-347

Hype score: Not currently trending

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References