CVE-2025-36854 – EOL ASP.NET 6.0 Remote Code Execution Vulnerability

CVE ID : CVE-2025-36854

Published : Sept. 8, 2025, 2:15 p.m. | 38 minutes ago

Description : A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free, resulting in Remote Code Execution.

Per CWE-416: Use After Free https://cwe.mitre.org/data/definitions/416.html , Use After Free is when a product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

This issue affects EOL ASP.NET 6.0.0
Severity: 8.1 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…