CVE-2025-26646

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-26646
External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:microsoft:build_tools:*:*:*:*:*:visual_studio:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
History

10 Jul 2025, 14:54

Type Values Removed Values Added
References () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646 - () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646 - Vendor Advisory
First Time Microsoft visual Studio 2022
Apple
Microsoft build Tools
Microsoft
Apple macos
Microsoft .net
Linux
Microsoft windows
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:build_tools:*:*:*:*:*:visual_studio:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

16 May 2025, 14:43

Type Values Removed Values Added
Summary
  • (es) El control externo del nombre o la ruta de archivo en .NET, Visual Studio y Build Tools for Visual Studio permite que un atacante autorizado realice suplantación de identidad a través de una red.

13 May 2025, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-13 22:15

Updated : 2025-07-10 14:54

NVD link : CVE-2025-26646

Mitre link : CVE-2025-26646

CVE.ORG link : CVE-2025-26646

JSON object : View

Products Affected

linux

  • linux_kernel

microsoft

  • .net
  • windows
  • build_tools
  • visual_studio_2022

apple

  • macos
CWE
CWE-73

External Control of File Name or Path