Intel

AIKIDO-2025-10165

Microsoft.VisualStudio.Threading is vulnerable to Race Condition

Race Condition Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Mar 18, 2025

15

Low Risk

This Affects:

DOTNETMicrosoft.VisualStudio.Threading
17.5.10-alpha - 17.13.60
Fixed in 17.13.61
Are you affected? Scan for Free

TL;DR

Affected versions of the Microsoft.VisualStudio.Threading library are vulnerable to a race condition due to the lack of guaranteed ordering when reading this.joinableTask in the lock-free section of the logic. Under certain race conditions, AsyncLazy may wait on the inner task instead of the joinable task when two threads access this code simultaneously, potentially causing the program to hang and leading to a denial of service (DoS).

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

Microsoft.VisualStudio.Threading is vulnerable to Race Condition in versions 17.5.10-alpha - 17.13.60.

How to fix this

Upgrade the Microsoft.VisualStudio.Threading library to the patch version.