Overview
Microsoft’s ASP.NET has been identified with a critical vulnerability, CVE-2025-36854, that could potentially lead to system compromise or data leakage. This vulnerability, discovered in end-of-life (EOL) versions of ASP.NET, is significant due to its potential to enable remote code execution. It notably affects versions ASP.NET 6.0.0 to 6.0.36 and self-contained applications targeting these versions. Given the widespread usage of ASP.NET in web development, this vulnerability could potentially impact a significant number of applications and systems.
Vulnerability Summary
CVE ID: CVE-2025-36854
Severity: Critical, CVSS score of 8.1
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Remote Code Execution, potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
ASP.NET | 6.0.0 to 6.0.36
How the Exploit Works
The vulnerability is rooted in a use-after-free error condition that occurs when closing an HTTP/3 stream while application code is writing to the response body. This situation creates a race condition that can lead to use-after-free, which subsequently results in remote code execution. Essentially, the vulnerability arises from the improper handling of memory operations, specifically, it reuses or references memory after it has been freed. Any operations performed using the original pointer become invalid, leading to the potential execution of arbitrary code.
Conceptual Example Code
Below is a hypothetical example of how this vulnerability could be exploited. The example assumes an HTTP/3 stream is being closed while application code is writing to the response body:
POST /vulnerable/endpoint HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "command": "close_http3_stream", "data": "writing to response body" }In this example, the malicious actor sends a POST request to close the HTTP/3 stream while data is being written to the response body, triggering the use-after-free condition and potentially leading to remote code execution.
Recommended Mitigation
Due to the end-of-life status of the affected software components, Microsoft will not be releasing any further updates or support. As such, users are advised to apply a vendor patch or use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as a temporary mitigation measure. Furthermore, if you’ve deployed self-contained applications targeting any of the impacted versions, these applications must be recompiled and redeployed to ensure security.
