CVE-2025-55248

.NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability

State: Published
Severity: 4.8 Medium
Published: Oct 14, 2025
Updated: Feb 22, 2026
Reserved: Aug 11, 2025

Description

Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.

Scores

CVSS	Score	Vector	Source
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	microsoft

Weaknesses

CWE-326 Inadequate Encryption Strength

Affected Products

Product	Versions
.NET 8.0Microsoft	8.0.0 to before 8.0.21Affected
.NET 9.0Microsoft	9.0.0 to before 9.0.10Affected
Microsoft .NET Framework 2.0 Service Pack 2Microsoft	2.0.0 to before 2.0.50727.8981Affected
Microsoft .NET Framework 3.0 Service Pack 2Microsoft	3.0.0 to before 2.0.50727.8981Affected
Microsoft .NET Framework 3.5Microsoft	3.5.0 to before 2.0.50727.8981Affected
Microsoft .NET Framework 3.5 AND 4.7.2Microsoft	4.7.0 to before 4.7.04137.03Affected
Microsoft .NET Framework 3.5 AND 4.8Microsoft	4.8.0 to before 4.8.04798.02Affected
Microsoft .NET Framework 3.5 AND 4.8.1Microsoft	4.8.1 to before 4.8.1.09320.02Affected
Microsoft .NET Framework 3.5.1Microsoft	3.5.0 to before 2.0.50727.8981Affected
Microsoft .NET Framework 4.6.2Microsoft	4.7.0 to before 4.7.04137.03Affected
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2Microsoft	4.7.0 to before 4.7.04137.03Affected
Microsoft .NET Framework 4.8Microsoft	4.8.0 to before 4.8.04798.02Affected
Microsoft Visual Studio 2022 version 17.10Microsoft	17.10.0 to before 17.10.20Affected
Microsoft Visual Studio 2022 version 17.12Microsoft	17.12.0 to before 17.12.13Affected
Microsoft Visual Studio 2022 version 17.14Microsoft	17.14.0 to before 17.14.17Affected

References

.NET, .NET Framework, and Visual Studio Information Disclosure Vulnerabilityvendor-advisorypatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.