EUVD-2025-18115
GHSA-266m-wp2v-x7mq
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path verification
|
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates high impact but non-trivial exploitation barriers. Attack complexity is HIGH and requires user interaction (UI:R), substantially reducing likelihood compared to simpler vulnerabilities. The network attack vector is offset by these constraints—an attacker must either socially engineer a user to open a malicious project or compromise a shared development environment. Without confirmed KEV status, active POC, or EPSS probability data, this appears to be a moderate-to-high priority for .NET/Visual Studio users in shared or untrusted development environments, but not an emergency for isolated development setups. Organizations with strict code review and project source controls should see reduced risk. Development teams using untrusted or public repositories, or those accepting external project files, face elevated risk. |
| Exploit ScenarioDerived | An attacker crafts a malicious .NET project and hosts it on GitHub or a file-sharing service. A developer clones or downloads the project and opens it in Visual Studio. During project load or build, Visual Studio or the .NET runtime attempts to resolve dependencies, searching the project directory before system paths. The attacker has pre-placed a malicious assembly (e.g., 'System.Core.dll' or a commonly imported NuGet dependency) in a project subfolder. The runtime loads and executes the malicious assembly with the developer's privileges, potentially installing a backdoor, exfiltrating source code, or compromising build artifacts. Alternatively, an attacker compromises a shared network drive used for team project storage and plants malicious assemblies, affecting all team members who access projects from that location. The requirement for user interaction (opening a project) and high attack complexity (crafting a convincing project structure) reduce frequency but not impact—code execution as a developer can compromise intellectual property and infrastructure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
CVE-2025-30399 is an untrusted search path vulnerability in .NET and Visual Studio that allows unauthenticated remote attackers to execute arbitrary code through a network vector, requiring user interaction. The vulnerability affects multiple versions of .NET Framework and Visual Studio across Windows platforms. While the CVSS score is 7.5 (high), the attack complexity is high and requires user interaction, potentially limiting real-world exploitation frequency.
RemediationAI
- Immediate mitigation: Configure Visual Studio and .NET projects to disable assembly search in untrusted directories; review environment PATH variables and remove writable locations from assembly resolution order. 2. Patch deployment: Obtain and deploy the latest security updates from Microsoft for affected .NET Framework versions and Visual Studio releases via Windows Update or the Visual Studio Installer. 3. Access control: Restrict project directories and shared development environments to authenticated users; implement filesystem permissions to prevent unauthorized modification of project folders. 4. Best practices: Validate NuGet package sources and use private package feeds; implement code signing and package integrity verification; avoid opening untrusted or downloaded projects without review. 5. Vendor advisory: Monitor the Microsoft Security Update Guide (portal.msrc.microsoft.com) and subscribe to .NET runtime and Visual Studio release notes for patch availability and timeline. As of the CVE issuance date, a security patch should be available; deploy according to your organizational patch management schedule.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exploits CWE-426 (Untrusted Search Path), a class of issues where applications search for resources (libraries, modules, configuration files) in directories that an attacker can control or manipulate. In the .NET and Visual Studio ecosystem, this typically manifests when the runtime or IDE searches for assemblies, NuGet packages, or supporting libraries in the current working directory or other writable locations before checking system-protected paths. The untrusted search path allows an attacker to place malicious .NET assemblies or components in predictable locations (e.g., project directories, temporary folders, or shared network paths), which are then loaded and executed with the privileges of the user running Visual Studio or the .NET application. The network attack vector (AV:N) suggests this can be triggered remotely, possibly through shared project files, compromised NuGet feeds, or remote filesystem access.
Know when .Net gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.
Executive ViewAI
CVE-2025-30399 is a high-severity vulnerability affecting .NET and Visual Studio that could allow attackers to execute arbitrary code remotely on affected systems. Organizations using these development tools face potential compromise of source code, intellectual property, and development infrastructure if exploited.
Disable automatic path resolution in .NET/Visual Studio configurations; implement strict code signing and validation policies; enforce network segmentation isolating development infrastructure; deploy EDR (Endpoint Detection and Response) on all development systems; implement application whitelisting on build servers; restrict outbound network connectivity from development environments; require multi-factor authentication for all development system access; monitor and log all code execution on development infrastructure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Same weakness CWE-426 – Untrusted Search Path
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| trusty | DNE | - |
| xenial | DNE | - |
| bionic | DNE | - |
| focal | DNE | - |
| jammy | not-affected | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
| Release | Status | Version |
|---|---|---|
| trusty | DNE | - |
| xenial | DNE | - |
| bionic | DNE | - |
| focal | DNE | - |
| jammy | ignored | see notes |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
| Release | Status | Version |
|---|---|---|
| trusty | DNE | - |
| xenial | DNE | - |
| bionic | DNE | - |
| focal | DNE | - |
| jammy | released | 8.0.117-8.0.17-0ubuntu1~22.04.1 |
| noble | released | 8.0.117-8.0.17-0ubuntu1~24.04.1 |
| oracular | released | 8.0.117-8.0.17-0ubuntu1~24.10.1 |
| plucky | released | 8.0.117-8.0.17-0ubuntu1~25.04.1 |
| upstream | needs-triage | - |
| Release | Status | Version |
|---|---|---|
| trusty | DNE | - |
| xenial | DNE | - |
| bionic | DNE | - |
| focal | DNE | - |
| jammy | DNE | - |
| noble | DNE | - |
| oracular | released | 9.0.107-9.0.6-0ubuntu1~24.10.1 |
| plucky | released | 9.0.107-9.0.6-0ubuntu1~25.04.1 |
| upstream | needs-triage | - |
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB