Microsoft Net 6.0 vulnerabilities

3 CVEs affecting Microsoft Net 6.0, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-36855, published 2025-09-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-36855, published 2025-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read. Per CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html ,…
CVE-2025-36854, published 2025-09-08. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead…
CVE-2025-36853, published 2025-09-08. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability (CVE-2025-21172) exists in msdia140.dll due to integer overflow and heap-based overflow. Per CWE-122: Heap-based Buffer Overflow, a heap overflow condition is a buffer overflow,…