Skip to content
OpenAdvisories
High MSRC-CVE-2025-30399 1 CVE

.NET and Visual Studio Remote Code Execution Vulnerability

Published Jun 10, 2025 · Updated Jul 8, 2025 · Revision 2

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
This attack requires a victim to perform a specific action, such as copying files or executing a command, and for an attacker with appropriate access to have pre-planted malicious files with knowledge of where they should be placed on the victim's system.

According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution?
This attack requires a specially crafted file to be placed either in an online directory or in a local network location. When a victim runs this file, it loads the malicious DLL.

Security updates
7.4.11 — https://github.com/PowerShell/Announcements/issues/77
8.0.17 — https://support.microsoft.com/help/5061935
9.0.6 — https://support.microsoft.com/help/5061936
17.12.9 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes

Vulnerabilities 1

Revision history

  1. #2

    Revised the Security Updates table to include PowerShell 7.4 and PowerShell 7.5 because these versions of PowerShell 7 are affected by this vulnerability. See [https://github.com/PowerShell/Announcements/issues/77](https://github.com/PowerShell/Announcements/issues/77) for more information.

  2. #1

    Information published.

References