CVE-2025-55247

Overview

The .NET SDK is the set of libraries and tools used to build and run .NET applications. It bundles MSBuild, the build engine that executes project files and the tasks they invoke.

A Denial of Service vulnerability (CVE-2025-55247) has been identified in MSBuild's temporary directory handling on Linux, which allows another local user to interfere with a build. MSBuild created its temporary directory at a path derived from the user name, so any local user could predict it and create it first.

Per CWE-59: Improper Link Resolution Before File Access ('Link Following'), the product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link that resolves to an unintended resource.

This issue affects the .NET 6 SDK. It is a build-time issue and does not affect the runtime that applications execute on. Exposure is specific to Linux, and requires another user account on the same machine, so shared or multi-tenant build hosts are the realistic setting.

‍

Details

Module Info

• Product: .NET SDK
• Affected packages: Microsoft.Build, Microsoft.Build.Tasks.Core and Microsoft.Build.Utilities.Core (bundled in the .NET SDK)
• Affected versions: Microsoft.Build.Tasks.Core >= 17.8.0 <= 17.14.8, shipped as 17.3.4 in the .NET 6 SDK
• GitHub repository: https://github.com/dotnet/msbuild
• Published packages: Microsoft.Build.Tasks.Core on NuGet
• Package manager: NuGet
• Fixed in: NES for .NET 6.0.45, which bundles Microsoft.Build.* 17.3.4.1 from the HeroDevs feed

Vulnerability Info

This High-severity vulnerability is found in MSBuild's FileUtilities.CreateFolderUnderTemp. The build's temporary directory was composed as the system temporary path plus MSBuildTemp and the current user name, which makes it entirely predictable to anyone with a local account. On Linux the system temporary path is shared between users, so another user can create that directory before the build does.

The code anticipated the collision and handled it poorly. If the directory already existed it tried to take ownership by changing its permissions, and where that failed it walked a numbered series of alternatives. An attacker who can occupy the predictable path can occupy those alternatives too, and chmod follows symbolic links, which is the behaviour the assigned weakness describes.

The fixed release stops deriving the path from the user name. On Linux it creates a directory with an unpredictable name using mkdir with owner-only permissions, retrying on collision, so a name the build successfully creates is one no other user could have created first. The user name is dropped from the path on other platforms as well.

Applicability to .NET 6 was established from source and confirmed against the shipped artifact: on the 6.0.44 SDK the build created exactly the predictable path, and a second local user occupying it pushed the build onto the numbered fallback. Microsoft's published affected-version list starts at MSBuild 17.8.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade the .NET SDK to one bundling a fixed MSBuild, such as Microsoft.Build.Tasks.Core >= 17.8.43 or >= 17.14.28.
• Avoid running builds as multiple users on a shared Linux host, or give each build account its own temporary directory.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.45 or later.

‍

Credits

Microsoft did not publicly credit an individual finder for this vulnerability in its security advisory.