CVE-2025-26646

.NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability

State: Published
Severity: 8.0 High
Published: May 13, 2025
Updated: Feb 26, 2026
Reserved: Feb 12, 2025

Description

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	microsoft

Weaknesses

CWE-73 External Control of File Name or Path

Affected Products

Product	Versions
.NET 8.0Microsoft	8.0.0 to before 8.0.16Affected
.NET 9.0Microsoft	9.0.0 to before 9.0.5Affected
Build Tools for Visual Studio 2022Microsoft	17.0 to before Fixed Version 17.13.7Affected
Microsoft Visual Studio 2022 version 17.10Microsoft	17.10.0 to before 17.10.15Affected
Microsoft Visual Studio 2022 version 17.12Microsoft	17.12.0 to before 17.12.8Affected
Microsoft Visual Studio 2022 version 17.13Microsoft	17.13.0 to before 17.13.7Affected
Microsoft Visual Studio 2022 version 17.8Microsoft	17.8.0 to before 17.8.21Affected

References

.NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerabilityvendor-advisorypatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.