CVE-2025-26646: .NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability

High severity · published May 13, 2025

CVE-2025-26646

.NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability

8.0

CVSS

1.3%

EPSS

On KEV

Description

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.3% · higher than 70% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

.NET 8.0 · Microsoft

8.0.0 before 8.0.16 · source: vendor

.NET 9.0 · Microsoft

9.0.0 before 9.0.5 · source: vendor

Build Tools for Visual Studio 2022 · Microsoft

17.0 before Fixed Version 17.13.7 · source: vendor

Microsoft Visual Studio 2022 version 17.10 · Microsoft

17.10.0 before 17.10.15 · source: vendor

Microsoft Visual Studio 2022 version 17.12 · Microsoft

17.12.0 before 17.12.8 · source: vendor

Microsoft Visual Studio 2022 version 17.13 · Microsoft

17.13.0 before 17.13.7 · source: vendor

Microsoft Visual Studio 2022 version 17.8 · Microsoft

17.8.0 before 17.8.21 · source: vendor

.net · Microsoft

9.0.0 before 9.0.5; 8.0.0 before 8.0.16 · source: NVD

Build Tools · Microsoft

before 17.13.7 · source: NVD

Visual Studio 2022 · Microsoft

17.8.0 before 17.8.21; 17.10.0 before 17.10.15; 17.12.0 before 17.12.8; 17.13.0 before 17.13.7 · source: NVD

Affected product

.NET 8.0

Microsoft

All .NET 8.0 CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-26646

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-26646

Vendor Advisory

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646