The Update BureauKB5049622: Cumulative update for .NET Framework, versions 3.5 and 4.8.1, on Windows 11 24H2 and Windows Server 2025, January 2025. .NET RCE vulnerability addressed; rare runtime loop fixed
In short
Addresses CVE-2025-21176, a remote code execution vulnerability, and rare cases where a thread entering the .NET runtime for the first time could trigger an infinite loop.
Does it affect you? Applies to: Windows 11, version 24H2, and Windows Server 2025 devices with .NET Framework 3.5 or 4.8.1 installed.
What changes
Fixes 2 changes
.NET Framework
-
Addresses a remote code execution vulnerability in .NET Framework.1
Addresses CVE-2025-21176.
.NET Runtime
-
Addresses rare cases where a thread entering the .NET runtime for the first time could cause an infinite loop.2
Addresses an issue that could cause an infinite loop when a thread enters the CLR for the first time.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-01-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5048162, KB5045934, KB5044030
- Replaced by
- KB5066131
| Version | File version | Channel |
|---|---|---|
| 3.5 | 2.0.50727.9179 | General availability |
| 4.8.1 | 4.8.9290.0 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
|
Important | 8.8 |
Downloads (Microsoft Update Catalog)
x64
Windows 11, version 24H2 / Windows Server 2025
71.2 MB
Arm64
Windows 11, version 24H2 / Windows Server 2025
87.7 MB
Updated components
52 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| .NET runtime (CLR) | 12 |
| ASP.NET | 10 |
Sources
Updated
Cited passages from Microsoft's official notes (2)
-
1.
This security update addresses a remote code execution vulnerability detailed in CVE-2025-21176.
support.microsoft.com -
2.
Addresses an issue where in rare cases where an infinite loop could occur when a thread enters CLR for the first time.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake