Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-du1r-hgyq-z7c7
Vulnerability ID VCID-du1r-hgyq-z7c7
Aliases CVE-2021-34485
GHSA-vgwq-hfqc-58wv
Summary .NET Core Information Disclosure Vulnerability Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1 and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An information disclosure vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 when dumps created by the tool to collect crash dumps and dumps on demand are created with global read permissions on Linux and macOS. ### Patches * If you're using .NET 5.0, you should download and install Runtime 5.0.9 or SDK 5.0.206 (for Visual Studio 2019 v16.8) or SDK 5.0.303 (for Visual Studio 2019 V16.10) from https://dotnet.microsoft.com/download/dotnet-core/5.0. * If you're using .NET Core 3.1, you should download and install Runtime 3.1.18 or SDK 3.1.118 (for Visual Studio 2019 v16.4) or 3.1.412 (for Visual Studio 2019 v16.7 or later) from https://dotnet.microsoft.com/download/dotnet-core/3.1. * If you're using .NET Core 2.1, you should download and install Runtime 2.1.29 or SDK 2.1.525 (for Visual Studio 2019 v15.9) or 2.1.817 from https://dotnet.microsoft.com/download/dotnet-core/2.1. #### Other Details - Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/196 - An Issue for this can be found at https://github.com/dotnet/runtime/issues/57174 - MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34485
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-732 Incorrect Permission Assignment for Critical Resource
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-34485.json
epss 0.00665 https://api.first.org/data/v1/epss?cve=CVE-2021-34485
epss 0.00665 https://api.first.org/data/v1/epss?cve=CVE-2021-34485
epss 0.00665 https://api.first.org/data/v1/epss?cve=CVE-2021-34485
epss 0.00665 https://api.first.org/data/v1/epss?cve=CVE-2021-34485
epss 0.00665 https://api.first.org/data/v1/epss?cve=CVE-2021-34485
epss 0.00966 https://api.first.org/data/v1/epss?cve=CVE-2021-34485
epss 0.00966 https://api.first.org/data/v1/epss?cve=CVE-2021-34485
epss 0.00966 https://api.first.org/data/v1/epss?cve=CVE-2021-34485
epss 0.00966 https://api.first.org/data/v1/epss?cve=CVE-2021-34485
epss 0.00966 https://api.first.org/data/v1/epss?cve=CVE-2021-34485
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-vgwq-hfqc-58wv
cvssv3.1 5.5 https://github.com/dotnet/announcements/issues/196
generic_textual MODERATE https://github.com/dotnet/announcements/issues/196
cvssv3.1 5.5 https://github.com/dotnet/runtime/security/advisories/GHSA-vgwq-hfqc-58wv
cvssv3.1_qr MODERATE https://github.com/dotnet/runtime/security/advisories/GHSA-vgwq-hfqc-58wv
generic_textual MODERATE https://github.com/dotnet/runtime/security/advisories/GHSA-vgwq-hfqc-58wv
cvssv3.1 5.5 https://github.com/github/advisory-database/issues/741
generic_textual MODERATE https://github.com/github/advisory-database/issues/741
cvssv3.1 5.5 https://nvd.nist.gov/vuln/detail/CVE-2021-34485
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2021-34485
cvssv3.1 5.5 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34485
generic_textual MODERATE https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34485
archlinux Medium https://security.archlinux.org/AVG-2277
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-34485.json
https://api.first.org/data/v1/epss?cve=CVE-2021-34485
https://github.com/dotnet/announcements/issues/196
https://github.com/dotnet/runtime/security/advisories/GHSA-vgwq-hfqc-58wv
https://github.com/github/advisory-database/issues/741
https://nvd.nist.gov/vuln/detail/CVE-2021-34485
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34485
1990286 https://bugzilla.redhat.com/show_bug.cgi?id=1990286
AVG-2277 https://security.archlinux.org/AVG-2277
GHSA-vgwq-hfqc-58wv https://github.com/advisories/GHSA-vgwq-hfqc-58wv
RHSA-2021:3142 https://access.redhat.com/errata/RHSA-2021:3142
RHSA-2021:3143 https://access.redhat.com/errata/RHSA-2021:3143
RHSA-2021:3144 https://access.redhat.com/errata/RHSA-2021:3144
RHSA-2021:3145 https://access.redhat.com/errata/RHSA-2021:3145
RHSA-2021:3147 https://access.redhat.com/errata/RHSA-2021:3147
RHSA-2021:3148 https://access.redhat.com/errata/RHSA-2021:3148
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-34485.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/dotnet/announcements/issues/196
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/dotnet/runtime/security/advisories/GHSA-vgwq-hfqc-58wv
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/github/advisory-database/issues/741
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-34485
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34485
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.71226
EPSS Score 0.00665
Published At April 9, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:04:45.418398+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-vgwq-hfqc-58wv/GHSA-vgwq-hfqc-58wv.json 38.0.0