{"id":56739,"date":"2025-05-13T15:20:00","date_gmt":"2025-05-13T22:20:00","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/dotnet\/?p=56739"},"modified":"2025-05-22T10:55:14","modified_gmt":"2025-05-22T17:55:14","slug":"dotnet-and-dotnet-framework-may-2025-servicing-updates","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/dotnet\/dotnet-and-dotnet-framework-may-2025-servicing-updates\/","title":{"rendered":".NET and .NET Framework May 2025 servicing releases updates"},"content":{"rendered":"<p>Welcome to our combined .NET servicing updates for May 2025. Let&#8217;s get into the latest release of .NET &amp; .NET Framework, here is a quick overview of what&#8217;s new in our servicing releases:<\/p>\n<h2>Security improvements<\/h2>\n<p>We have released .NET 8.0.313 and .NET 8.0.410 which is an update to .NET 8.0.312 and .NET 8.0.409 SDK. Our May release for .NET 8.0.312 and .NET 8.0.409 missed a fix for CVE-2025-26646 which impacts Microsoft.Build.Tasks.core.dll.<\/p>\n<blockquote>\n<p>Note that there is no change to the .NET 8.0.16 runtime, this is an SDK only change. No action is required if you&#8217;re only deploying the .NET 8 runtime, but if you&#8217;re deploying the .NET 8 SDK then you will need to pick up the re-release with the fix.<\/p>\n<\/blockquote>\n<p><div class=\"alert alert-info\"><p class=\"alert-divider\"><i class=\"fabric-icon fabric-icon--Info\"><\/i><strong>Security Update<\/strong><\/p>\nAll developers using .NET 8.0 and .NET 9.0 should update immediately due to a spoofing vulnerability in MSBuild (CVE-2025-26646). This affects .NET 8.0 (versions 8.0.1xx and 8.0.4xx) and .NET 9.0 (versions 9.0.1xx through 9.0.3xx), as well as multiple Visual Studio versions. The vulnerability could allow attackers to spoof trusted content, potentially compromising build processes in development and CI\/CD environments.\n<\/div><\/p>\n<p>This month you will find that these CVEs have been fixed:<\/p>\n<table>\n<thead>\n<tr>\n<th>CVE #<\/th>\n<th>Title<\/th>\n<th>Applies to<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-26646\">CVE-2025-26646<\/a><\/td>\n<td>.NET and Visual Studio Spoofing Vulnerability<\/td>\n<td>.NET 9.0, .NET 8.0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<table>\n<thead>\n<tr>\n<th><\/th>\n<th>.NET 8.0<\/th>\n<th>.NET 9.0<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Release Notes<\/td>\n<td><a href=\"https:\/\/github.com\/dotnet\/core\/blob\/main\/release-notes\/8.0\/8.0.16\/8.0.16.md\">8.0.16<\/a><\/td>\n<td><a href=\"https:\/\/github.com\/dotnet\/core\/blob\/main\/release-notes\/9.0\/9.0.5\/9.0.5.md\">9.0.5<\/a><\/td>\n<\/tr>\n<tr>\n<td>Installers and binaries<\/td>\n<td><a href=\"https:\/\/dotnet.microsoft.com\/download\/dotnet\/8.0\">8.0.16<\/a><\/td>\n<td><a href=\"https:\/\/dotnet.microsoft.com\/download\/dotnet\/9.0\">9.0.5<\/a><\/td>\n<\/tr>\n<tr>\n<td>Container Images<\/td>\n<td><a href=\"https:\/\/mcr.microsoft.com\/catalog?search=dotnet\/\">images<\/a><\/td>\n<td><a href=\"https:\/\/mcr.microsoft.com\/catalog?search=dotnet\/\">images<\/a><\/td>\n<\/tr>\n<tr>\n<td>Linux packages<\/td>\n<td><a href=\"https:\/\/github.com\/dotnet\/core\/blob\/main\/release-notes\/8.0\/install-linux.md\">8.0.16<\/a><\/td>\n<td><a href=\"https:\/\/github.com\/dotnet\/core\/blob\/main\/release-notes\/9.0\/install-linux.md\">9.0.5<\/a><\/td>\n<\/tr>\n<tr>\n<td>Known Issues<\/td>\n<td><a href=\"https:\/\/github.com\/dotnet\/core\/blob\/main\/release-notes\/8.0\/known-issues.md\">8.0<\/a><\/td>\n<td><a href=\"https:\/\/github.com\/dotnet\/core\/blob\/main\/release-notes\/9.0\/known-issues.md\">9.0<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Release changelogs<\/h3>\n<ul>\n<li>ASP.NET Core:  <a href=\"https:\/\/github.com\/dotnet\/aspnetcore\/issues?q=milestone%3A8.0.16%20is%3Aclosed%20label%3Aservicing-approved%20\">8.0.16<\/a> | <a href=\"https:\/\/github.com\/dotnet\/aspnetcore\/issues?q=milestone%3A9.0.5%20is%3Aclosed%20label%3Aservicing-approved%20\">9.0.5<\/a><\/li>\n<li>Entity Framework Core: <a href=\"https:\/\/github.com\/dotnet\/efcore\/releases\/tag\/v9.0.5\">9.0.5<\/a><\/li>\n<li>Runtime: <a href=\"https:\/\/github.com\/dotnet\/runtime\/issues?q=milestone%3A8.0.16%20is%3Aclosed%20label%3Aservicing-approved%20\">8.0.16<\/a> | <a href=\"https:\/\/github.com\/dotnet\/runtime\/issues?q=milestone%3A9.0.5%20is%3Aclosed%20label%3Aservicing-approved%20\">9.0.5<\/a><\/li>\n<li>SDK: <a href=\"https:\/\/github.com\/dotnet\/sdk\/issues?q=milestone%3A8.0.16%20is%3Aclosed%20label%3Aservicing-approved%20\">8.0.16<\/a> | <a href=\"https:\/\/github.com\/dotnet\/sdk\/issues?q=milestone%3A9.0.5%20is%3Aclosed%20label%3Aservicing-approved%20\">9.0.5<\/a><\/li>\n<\/ul>\n<p>Share feedback about this release in the <a href=\"https:\/\/github.com\/dotnet\/core\/issues\/9885\">Release feedback issue<\/a>.<\/p>\n<h2>.NET Framework May 2025 Updates<\/h2>\n<p>This month, there are no new security and non-security updates. For recent .NET Framework servicing updates, be sure to browse our <a href=\"https:\/\/learn.microsoft.com\/dotnet\/framework\/release-notes\/release-notes\">release notes for .NET Framework<\/a> for more details.<\/p>\n<h2>See you next month<\/h2>\n<p>That&#8217;s it for this month, make sure you update to the latest service release today.<\/p>\n<p><!-- Note: The following links are currently not used in this document. They are included as comments for potential use in future releases.\n[winforms-9-0-4]: https:\/\/github.com\/dotnet\/winforms\/issues?q=milestone%3A9.0.4%20is%3Aclosed%20label%3Aservicing-approved%20\n[roslyn-8-0-14]: https:\/\/github.com\/dotnet\/roslyn-analyzers\/issues?q=milestone%3A8.0.12xx+is%3Aclosed+label%3Aservicing-approved+\n[roslyn-9-0-3]: https:\/\/github.com\/dotnet\/roslyn-analyzers\/issues?q=milestone%3A9.0.1xx+is%3Aclosed+label%3Aservicing-approved+\n[efcore-8-0-14]: https:\/\/github.com\/dotnet\/efcore\/releases\/tag\/v8.0.14\n[wpf-9-0-3]: https:\/\/github.com\/dotnet\/wpf\/releases\/tag\/v9.0.3\n[maui-9-0-3]: https:\/\/github.com\/dotnet\/maui\/releases\/tag\/9.0.3\n[wpf-8-0-14]: https:\/\/github.com\/dotnet\/wpf\/releases\/tag\/v8.0.14\n[templating-8-0-14]: https:\/\/github.com\/dotnet\/templating\/releases\/tag\/v8.0.406\n[templating-9-0-3]: https:\/\/github.com\/dotnet\/templating\/releases\/tag\/v9.0.300\n[winforms-8-0-14]: https:\/\/github.com\/dotnet\/winforms\/issues?q=milestone%3A8.0.14%20is%3Aclosed%20label%3Aservicing-approved%20\n--><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A recap of the latest servicing updates for .NET and .NET Framework for May 2025.<\/p>\n","protected":false},"author":369,"featured_media":56856,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[685,195,7600],"tags":[4,11],"class_list":["post-56739","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dotnet","category-dotnet-framework","category-maintenance-and-updates","tag-net","tag-net-framework"],"acf":[],"blog_post_summary":"<p>A recap of the latest servicing updates for .NET and .NET Framework for May 2025.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/posts\/56739","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/users\/369"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/comments?post=56739"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/posts\/56739\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/media\/56856"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/media?parent=56739"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/categories?post=56739"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/tags?post=56739"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}