CVE-2025-26646

Published: May 13, 2025Modified: Jun 17, 2026

8.0

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.1 / Impact: 5.9

Source: secure@microsoft.com (Secondary)

Description

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.

Affected (7)

Products: Microsoft: Build Tools, Visual Studio 2022, .net

3 products

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Microsoft Build Tools	Before 17.13.7
Microsoft Visual Studio 2022	From 17.10.0 to 17.10.15
Microsoft Visual Studio 2022	From 17.12.0 to 17.12.8
Microsoft Visual Studio 2022	From 17.13.0 to 17.13.7
Microsoft Visual Studio 2022	From 17.8.0 to 17.8.21

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Microsoft .net	From 9.0.0 to 9.0.5

Configuration C

1 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Microsoft .net	From 8.0.0 to 8.0.16

Running on/with	Platform Versions
Apple Macos	All versions
Linux Linux Kernel	All versions
Microsoft Windows	All versions

Related CWEs

CWE-73

External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.