CVE-2025-36855: ASP.NET Buffer Overflow Vulnerability

CVE-2025-36855 Overview

CVE-2025-36855 is a buffer over-read vulnerability in DiaSymReader.dll, a component used by ASP.NET runtime environments. The flaw allows reads beyond the bounds of a targeted buffer through indexes or pointers referencing memory after the buffer boundary. It mirrors CVE-2025-21176 and affects End-of-Life (EOL) ASP.NET 6.0.0 through 6.0.36. Microsoft has confirmed no future updates or support will be provided for these EOL components. Self-contained applications compiled against affected versions remain vulnerable and require recompilation against supported runtimes.

Critical Impact
A network-based attacker can trigger memory disclosure and potentially execute code in the context of vulnerable ASP.NET applications, with high impact to confidentiality, integrity, and availability.

Affected Products

ASP.NET 6.0.0 through 6.0.36 (End of Life)
ASP.NET 8.0.0 through 8.0.11 (tracked under CVE-2025-21176)
ASP.NET 9.0.0 (tracked under CVE-2025-21176)
Self-contained .NET applications compiled against affected runtimes

Discovery Timeline

2025-09-08 - CVE-2025-36855 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-36855

Vulnerability Analysis

The vulnerability resides in DiaSymReader.dll, a debugging symbol reader used by the .NET runtime to process Program Database (PDB) symbol information. The component performs buffer access using indexes or pointers that reference memory locations past the end of the intended buffer. This classifies as [CWE-126: Buffer Over-read].

When DiaSymReader.dll processes malformed symbol data, it reads memory beyond the targeted buffer boundary. The exposed memory may contain sensitive runtime data, pointers, or other process state. The attack vector requires user interaction, indicating exploitation depends on a victim processing attacker-controlled content. The combination of high confidentiality, integrity, and availability impact suggests the over-read condition can be chained into broader memory corruption outcomes.

Root Cause

The root cause is missing bounds validation in buffer access logic within DiaSymReader.dll. The component reads from a buffer using access mechanisms that do not verify whether the index or pointer remains within allocated memory. Inputs crafted to exploit this missing check trigger reads past the buffer end.

Attack Vector

An attacker delivers crafted symbol data or content processed by a vulnerable ASP.NET application. User interaction is required, such as loading a malicious file or visiting attacker-controlled content. Successful exploitation returns out-of-bounds memory contents to the attacker or destabilizes the process. Because this affects EOL software, no vendor patch will be issued for ASP.NET 6.0.x. See the Microsoft Security Update Guide and the HeroDevs Vulnerability Directory for technical context.

Detection Methods for CVE-2025-36855

Indicators of Compromise

Unexpected crashes or access violations in ASP.NET worker processes loading DiaSymReader.dll
Anomalous PDB or symbol file loads originating from untrusted locations
Memory dumps from w3wp.exe or dotnet.exe processes showing access violations in symbol-reader code paths
Outbound connections from ASP.NET hosts immediately following symbol processing operations

Detection Strategies

Inventory all ASP.NET deployments and identify hosts running runtime versions 6.0.0 through 6.0.36
Identify self-contained .NET applications by scanning for embedded DiaSymReader.dll files matching vulnerable versions
Monitor Windows Error Reporting and Application event logs for faulting modules referencing DiaSymReader.dll
Inspect file system telemetry for PDB files written to or loaded from ASP.NET application directories

Monitoring Recommendations

Collect process telemetry from ASP.NET hosts and forward to a centralized analytics platform for correlation
Alert on module load events for DiaSymReader.dll from non-standard paths
Track outbound network connections from ASP.NET worker processes against expected baselines
Audit recompilation status of self-contained applications to confirm migration off EOL runtimes

How to Mitigate CVE-2025-36855

Immediate Actions Required

Migrate all ASP.NET workloads from EOL version 6.0.x to a supported runtime such as 8.0.12 or later
Recompile and redeploy self-contained applications targeting affected runtimes against patched .NET versions
Restrict network exposure of ASP.NET applications running EOL runtimes until migration completes
Apply application-layer input validation to reject malformed symbol files or untrusted content

Patch Information

Microsoft will not release a patch for ASP.NET 6.0.x because the runtime has reached End of Life. For supported branches tracked under CVE-2025-21176, upgrade to ASP.NET 8.0.12 or later, or ASP.NET 9.0.1 or later. Refer to the Microsoft Security Update Guide for supported version details. Organizations unable to migrate immediately may evaluate third-party extended support offerings such as those listed in the HeroDevs Vulnerability Directory.

Workarounds

Isolate EOL ASP.NET 6.0 workloads behind reverse proxies that filter untrusted input
Disable processing of attacker-controlled symbol or debug files in production environments
Apply principle of least privilege to ASP.NET worker process accounts to limit post-exploitation impact
Enforce egress filtering on ASP.NET hosts to constrain potential data exfiltration

bash

# Identify .NET runtime versions on Windows hosts
dotnet --list-runtimes

# Upgrade ASP.NET application target framework in .csproj
# Replace: <TargetFramework>net6.0</TargetFramework>
# With:    <TargetFramework>net8.0</TargetFramework>

# Rebuild self-contained applications against a supported runtime
dotnet publish -c Release -r win-x64 --self-contained true -f net8.0