Dottrace
Monthly
Local privilege escalation in JetBrains ReSharper, Rider, and dotTrace before 2025.2.5 lets an attacker who already holds a low-privileged local account win a time-of-check-to-time-of-use race condition against a higher-privileged operation and gain that operation's privileges on the same host. The issue is rated 7.0 (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H), meaning it is authenticated-local and non-deterministic - typically requiring repeated attempts - and no public exploit identified at time of analysis (EPSS 0.00%, not in CISA KEV). Realistic exposure is limited to multi-user or developer endpoints where the tool or its elevated helper, installer, or updater is present.
In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local. Rated high severity (CVSS 7.8). No vendor patch available.
Local privilege escalation in JetBrains ReSharper, Rider, and dotTrace before 2025.2.5 lets an attacker who already holds a low-privileged local account win a time-of-check-to-time-of-use race condition against a higher-privileged operation and gain that operation's privileges on the same host. The issue is rated 7.0 (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H), meaning it is authenticated-local and non-deterministic - typically requiring repeated attempts - and no public exploit identified at time of analysis (EPSS 0.00%, not in CISA KEV). Realistic exposure is limited to multi-user or developer endpoints where the tool or its elevated helper, installer, or updater is present.
In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local. Rated high severity (CVSS 7.8). No vendor patch available.