The Update BureauKB5049621: Cumulative update for .NET Framework, versions 3.5 and 4.8.1, on Windows 10 21H2/22H2, January 2025. Remote code execution flaw and rare CLR loop addressed
In short
The update addresses CVE-2025-21176, a .NET Framework remote code execution vulnerability, and a rare case where a thread could enter an infinite loop.
Does it affect you? Applies to: Devices running Windows 10 Version 21H2 or 22H2 with .NET Framework 3.5 or 4.8.1 installed.
What changes
Fixes 2 changes
.NET Framework
-
Addresses a remote code execution vulnerability in .NET Framework.1
Addresses CVE-2025-21176.
.NET Runtime
-
Addresses rare cases where a thread could get stuck in an infinite loop the first time it enters the CLR.2
Addresses an issue where an infinite loop could occur when a thread enters CLR for the first time.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-01-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5045933, KB5044029
- Replaced by
- KB5066130
| Version | File version | Channel |
|---|---|---|
| 3.5 | 2.0.50727.9179 | General availability |
| 4.8.1 | 4.8.9290.0 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
|
Not rated | — |
Downloads (Microsoft Update Catalog)
x64
Windows 10 Enterprise LTSC 2021 / Windows 10, version 22H2
75.2 MB
x86
Windows 10 Enterprise LTSC 2021 / Windows 10, version 22H2
46.9 MB
Updated components
58 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| .NET runtime (CLR) | 18 |
| ASP.NET | 15 |
Sources
Updated
Cited passages from Microsoft's official notes (2)
-
1.
This security update addresses a remote code execution vulnerability detailed in CVE-2025-21176.
support.microsoft.com -
2.
Addresses an issue where in rare cases where an infinite loop could occur when a thread enters CLR for the first time.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake