CVE-2025-23385

In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4,…

High7.8EPSS 0.14%

Published: 28 Jan 2025
Updated: 28 Jan 2025
Reserved: 15 Jan 2025
Assigned by: JetBrains

Description

In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible

Scores

CVSS scores of CVE-2025-23385, by who scored it
Scored by	CVSS	Score	Vector
JetBrainsCNA (assigner)	3.1	High7.8	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
NVDNVD · Analyzed	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.14% · top 97% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

CWE-114: Process Control (opens in a new tab)All about CWE-114 and its CVEs

Affected products

JetBrains · ReSharper
- affected 2024.3 – < 2024.3.4
- affected 2024.2 – < 2024.2.8
- affected < 2024.1.7
JetBrains · Rider
- affected 2024.3 – < 2024.3.4
- affected 2024.2 – < 2024.2.8
- affected < 2024.1.7
JetBrains · dotTrace
- affected 2024.3 – < 2024.3.4
- affected 2024.2 – < 2024.2.8
- affected < 2024.1.7
JetBrains · ETW Host Service
- affected < 16.43

References (1)

https://www.jetbrains.com/privacy-security/issues-fixed/ (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-23385](https://trackcve.app/badge/CVE-2025-23385.svg)](https://trackcve.app/cve/CVE-2025-23385)

Record last updated 28 Jan 2025, 16:26 UTC.