CVE-2025-55247
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. The vulnerability affects link handling in .NET.
Risk Assessment
An authenticated low-privileged attacker can exploit this to gain higher privileges on the system. This may lead to compromise of the application or data.
Recommendation
Update the .NET runtime to a patched version. Restrict the ability to create links in directories used by applications.
Other vulnerabilities in .NET
See all- CVE-2026-50649High
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.
- CVE-2023-36049High
A vulnerability in .NET, .NET Framework, and Visual Studio allows elevation of privilege. Technical details are not provided in the description, but the flaw may allow an attacker to gain higher privileges on the system.
- CVE-2026-96960High
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
- CVE-2026-96959High
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
- CVE-2026-96958High
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
- CVE-2026-96957High
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-96238Medium
Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-96237High
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
- CVE-2026-96235High
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
- CVE-2026-96234Medium
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
Original NVD description (English source)
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS