CVE-2025-21172

A remote code execution vulnerability was found in .NET. This flaw allows an attacker to load a specially crafted file in .NET.

This issue affects .NET Framework as shipped with all versions of RHEL. However, this flaw is not known to be exploitable under any supported scenario.

.NET 6.0 for RHEL-8, RHEL-9 and RHIVOS has reached its End of Life as of November 12, 2024, and is no longer supported. No fixes will be provided for this stream. For additional information about lifecycle for .NET on Red Hat Enterprise Linux, please refer to: https://access.redhat.com/support/policy/updates/net-core.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.