The Update BureauKB5049617: Cumulative update for .NET Framework, versions 3.5 and 4.8, on Windows Server 2022, January 2025. .NET runtime remote-code flaw and rare thread-entry hang addressed
In short
The update addresses one remote-code-execution vulnerability in .NET Framework and a rare .NET runtime infinite-loop problem when a thread enters the CLR for the first time.
Does it affect you? Applies to: Windows Server 2022 devices with .NET Framework 3.5 or 4.8 installed.
What changes
Fixes 2 changes
.NET Framework
For: Windows Server 2022 devices with .NET Framework 3.5 or 4.8
-
A remote-code-execution vulnerability in .NET Framework is addressed.1
Addresses CVE-2025-21176.
.NET Runtime
For: Devices where a thread enters the runtime for the first time
-
A rare infinite loop that could occur when a thread first enters the .NET runtime is addressed.2
The issue could occur when a thread enters the CLR for the first time.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-01-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5046265, KB5044025
- Replaced by
- KB5066139
| Version | File version | Channel |
|---|---|---|
| 3.5 | 2.0.50727.9179 | General availability |
| 4.8 | 4.8.4775.0 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
|
Not rated | — |
Downloads (Microsoft Update Catalog)
x64
Windows Server 2022
72.2 MB
Updated components
20 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| .NET runtime (CLR) | 12 |
Sources
Updated
Cited passages from Microsoft's official notes (2)
-
1.
This security update addresses a remote code execution vulnerability detailed in CVE-2025-21176.
support.microsoft.com -
2.
Addresses an issue where in rare cases where an infinite loop could occur when a thread enters CLR for the first time.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake