CVE-2025-55248

Published: Oct 14, 2025Modified: Jun 17, 2026

5.7

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.1 / Impact: 3.6

Source: NVD

Description

Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.

Affected (14)

Products: Microsoft: .net Framework, .net, Visual Studio 2022

3 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 4.7.1
Microsoft .net Framework	Version 4.7

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 4.6.2

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 3.5.1

Configuration D

1 vulnerable · 5 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 4.8.1

Running on/with	Platform Versions
Microsoft Windows 11 22h2	All versions
Microsoft Windows 11 23h2	All versions
Microsoft Windows 11 24h2	All versions
Microsoft Windows 11 25h2	All versions
Microsoft Windows Server 2022 23h2	All versions

Configuration E

3 platform

Running on/with	Platform Versions
Microsoft Windows 10 21h2	All versions
Microsoft Windows 10 22h2	All versions
Microsoft Windows Server 2022	All versions

Configuration F

1 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 4.7.2

Running on/with	Platform Versions
Microsoft Windows 10 1809	All versions
Microsoft Windows 10 1809	All versions
Microsoft Windows Server 2019	All versions

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 3.5

Configuration H

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 3.0 sp2

Running on/with	Platform Versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions

Configuration I

2 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Microsoft .net	From 8.0.0 to 8.0.21
Microsoft .net	From 9.0.0 to 9.0.10

Running on/with	Platform Versions
Apple Macos	All versions
Linux Linux Kernel	All versions
Microsoft Windows	All versions

Configuration J

3 vulnerable

Vulnerable Software	Affected Versions
Microsoft Visual Studio 2022	From 17.10.0 to 17.10.20
Microsoft Visual Studio 2022	From 17.12.0 to 17.12.13
Microsoft Visual Studio 2022	From 17.14.0 to 17.14.17

Configuration K

1 vulnerable · 6 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 4.8

Running on/with	Platform Versions
Microsoft Windows 10 1607	All versions
Microsoft Windows 10 1607	All versions
Microsoft Windows Server 2008	Version r2 sp1
Microsoft Windows Server 2012	All versions
Microsoft Windows Server 2012	Version r2
Microsoft Windows Server 2016	All versions

Related CWEs

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55248

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.