.NET 8 Runtime CVE-2025-55247

Exploitation requires LOCAL access as an already-authenticated low-privileged user (AV:L, PR:L) and user interaction (UI:R) - meaning a higher-privileged user or process must perform an action that follows the attacker-controlled symbolic link. The affected component is the .NET 8 runtime (fixed at 8.0.21-r0 on Alpine); hosts must be running an unpatched .NET 8 runtime for the link-following (CWE-59) condition to be reachable. Limiting factors that reduce realistic risk: there is no network vector (not remotely exploitable), the attacker must already have a local foothold, and the required user interaction means the flaw cannot be triggered purely autonomously by the attacker. The exact feature/code path that follows the link is not specified in the provided description and should be confirmed against the Microsoft MSRC advisory.

Signals converge on this being a genuine-but-low-urgency local privilege/integrity issue rather than a mass-exploitation priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R) describes a LOCAL vulnerability requiring an already-authenticated low-privileged user plus user interaction - not a remotely reachable flaw - so despite the 7.3 base score driven by C:H/I:H/A:H, the real-world attack surface is constrained to local actors. EPSS strongly agrees: 0.02% (4th percentile) places exploitation probability near the floor. There is no CISA KEV listing and no POC referenced in the provided data, so by the precision rules this is 'no public exploit identified at time of analysis.' The CWE-59 (link-following/symlink) classification is consistent with a local time-of-check/time-of-use style elevation of privilege. One tension to flag explicitly: the input Tags label this 'Information Disclosure,' but the CVSS vector asserts full integrity and availability impact (I:H/A:H) alongside confidentiality, which is characteristic of elevation-of-privilege rather than pure info disclosure - treat the 'Information Disclosure' tag as incomplete and verify the precise impact against the Microsoft MSRC advisory. Net assessment: patch in normal cycles; this is a real local-privilege defect but not an emergency.

A low-privileged local user on a Linux host running the vulnerable .NET 8 runtime plants or manipulates a symbolic link in a path the runtime accesses, then induces a higher-privileged process or user to perform an operation that follows the link (the UI:R / interaction requirement). Because of the link-following flaw (CWE-59), the privileged operation acts on an attacker-chosen target, yielding file read/write or code execution at elevated privilege. No public exploit code is identified in the provided data, so this scenario is inferred from the CVSS vector and CWE rather than a published PoC.