{"id":"CVE-2025-26646","state":"PUBLISHED","title":".NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability","description":"External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.","publishedAt":"2025-05-13T21:39:52.529Z","updatedAt":"2026-02-26T18:28:10.342Z","severity":{"score":8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft .NET 8.0","Microsoft .NET 9.0","Microsoft Build Tools for Visual Studio 2022","Microsoft Microsoft Visual Studio 2022 version 17.10","Microsoft Microsoft Visual Studio 2022 version 17.12","Microsoft Microsoft Visual Studio 2022 version 17.13","Microsoft Microsoft Visual Studio 2022 version 17.8"],"affected":[{"vendor":"Microsoft","product":".NET 8.0","versions":[{"version":"8.0.0","status":"affected","lessThan":"8.0.16","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 9.0","versions":[{"version":"9.0.0","status":"affected","lessThan":"9.0.5","versionType":"custom"}]},{"vendor":"Microsoft","product":"Build Tools for Visual Studio 2022","versions":[{"version":"17.0","status":"affected","lessThan":"Fixed Version 17.13.7","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.10","versions":[{"version":"17.10.0","status":"affected","lessThan":"17.10.15","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.12","versions":[{"version":"17.12.0","status":"affected","lessThan":"17.12.8","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.13","versions":[{"version":"17.13.0","status":"affected","lessThan":"17.13.7","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.8","versions":[{"version":"17.8.0","status":"affected","lessThan":"17.8.21","versionType":"custom"}]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646"],"weaknesses":["CWE-73"],"ingestedAt":"2026-10-29T20:08:47.682Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/26xxx/CVE-2025-26646.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-26646","state":"PUBLISHED","datePublished":"2025-05-13T21:39:52.529Z","dateUpdated":"2026-02-26T18:28:10.342Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2025-02-12T19:23:29.269Z"},"containers":{"cna":{"title":".NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability","descriptions":[{"lang":"en-US","value":"External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network."}],"affected":[{"vendor":"Microsoft","product":".NET 8.0","versions":[{"version":"8.0.0","status":"affected","lessThan":"8.0.16","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 9.0","versions":[{"version":"9.0.0","status":"affected","lessThan":"9.0.5","versionType":"custom"}]},{"vendor":"Microsoft","product":"Build Tools for Visual Studio 2022","versions":[{"version":"17.0","status":"affected","lessThan":"Fixed Version 17.13.7","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.10","versions":[{"version":"17.10.0","status":"affected","lessThan":"17.10.15","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.12","versions":[{"version":"17.12.0","status":"affected","lessThan":"17.12.8","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.13","versions":[{"version":"17.13.0","status":"affected","lessThan":"17.13.7","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Visual Studio 2022 version 17.8","versions":[{"version":"17.8.0","status":"affected","lessThan":"17.8.21","versionType":"custom"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646","name":".NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-73","description":"CWE-73: External Control of File Name or Path","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2026-02-13T19:20:48.274Z"},"datePublic":"2025-05-13T07:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.0.16"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.5"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.12.0","versionEndExcluding":"17.12.8"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.13.0","versionEndExcluding":"17.13.7"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.8.0","versionEndExcluding":"17.8.21"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.10.0","versionEndExcluding":"17.10.15"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:build_tools_for_visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.0","versionEndExcluding":"Fixed Version 17.13.7"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-26646","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-05-15T04:01:53.659212Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T18:28:10.342Z"}}]}}}