CVE-2025-23385

Published: Jan 28, 2025Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible

Affected (10)

Products: Jetbrains: Dottrace, Etw Host Service, Resharper, Rider

4 products

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Jetbrains Dottrace	Before 2024.1.7
Jetbrains Dottrace	From 2024.2 to 2024.2.8
Jetbrains Dottrace	From 2024.3 to 2024.3.4
Jetbrains Etw Host Service	Before 16.43
Jetbrains Resharper	Before 2024.1.7
Jetbrains Resharper	From 2024.2 to 2024.2.8
Jetbrains Resharper	From 2024.3 to 2024.3.4
Jetbrains Rider	Before 2024.1.7
Jetbrains Rider	From 2024.2.0 to 2024.2.8
Jetbrains Rider	From 2024.3.0 to 2024.3.4

Related CWEs

CWE-114

Process Control

Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.

References (1)

https://www.jetbrains.com/privacy-security/issues-fixed/

Source: cve@jetbrains.com

Vendor Advisory

Timeline

No history available yet.