Resharper
Monthly
Local privilege escalation in JetBrains ReSharper, Rider, and dotTrace before 2025.2.5 lets an attacker who already holds a low-privileged local account win a time-of-check-to-time-of-use race condition against a higher-privileged operation and gain that operation's privileges on the same host. The issue is rated 7.0 (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H), meaning it is authenticated-local and non-deterministic - typically requiring repeated attempts - and no public exploit identified at time of analysis (EPSS 0.00%, not in CISA KEV). Realistic exposure is limited to multi-user or developer endpoints where the tool or its elevated helper, installer, or updater is present.
In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.
In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local. Rated high severity (CVSS 7.8). No vendor patch available.
JetBrains ReSharper installers for versions before 2019.2 had a DLL Hijacking vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Local privilege escalation in JetBrains ReSharper, Rider, and dotTrace before 2025.2.5 lets an attacker who already holds a low-privileged local account win a time-of-check-to-time-of-use race condition against a higher-privileged operation and gain that operation's privileges on the same host. The issue is rated 7.0 (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H), meaning it is authenticated-local and non-deterministic - typically requiring repeated attempts - and no public exploit identified at time of analysis (EPSS 0.00%, not in CISA KEV). Realistic exposure is limited to multi-user or developer endpoints where the tool or its elevated helper, installer, or updater is present.
In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.
In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local. Rated high severity (CVSS 7.8). No vendor patch available.
JetBrains ReSharper installers for versions before 2019.2 had a DLL Hijacking vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.