CVE-2025-26646: .NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-13 · updated 2026-06-17
Weakness: CWE-73

Description

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.

Affected products

Microsoft .NET: from 9.0.0 before 9.0.5; from 8.0.0 before 8.0.16 — fixed in 8.0.16, 9.0.5
Microsoft Build Tools: before 17.13.7 — fixed in 17.13.7
Microsoft Visual Studio 2022 version 17.14: from 17.8.0 before 17.8.21; from 17.10.0 before 17.10.15; from 17.12.0 before 17.12.8; from 17.13.0 before 17.13.7 — fixed in 17.10.15, 17.12.8, 17.13.7, 17.8.21
Microsoft .NET 8.0: from 8.0.0 before 8.0.16 — fixed in 8.0.16
Microsoft .NET 9.0: from 9.0.0 before 9.0.5 — fixed in 9.0.5
Microsoft Build Tools for Visual Studio 2022: from 17.0 before Fixed Version 17.13.7 — fixed in Fixed Version 17.13.7
Microsoft Visual Studio 2022 version 17.10: from 17.10.0 before 17.10.15 — fixed in 17.10.15
Microsoft Visual Studio 2022 version 17.13: from 17.13.0 before 17.13.7 — fixed in 17.13.7
Microsoft Visual Studio 2022 version 17.8: from 17.8.0 before 17.8.21 — fixed in 17.8.21
Microsoft Visual Studio 2022 version 17.14: from 17.12.0 before 17.12.8 — fixed in 17.12.8

How to fix

Upgrade to a fixed version: Microsoft .NET 8.0.16, 9.0.5; Microsoft Build Tools 17.13.7; Microsoft Visual Studio 2022 version 17.14 17.10.15, 17.12.8, 17.13.7, 17.8.21; Microsoft .NET 8.0 8.0.16; Microsoft .NET 9.0 9.0.5; Microsoft Build Tools for Visual Studio 2022 Fixed Version 17.13.7; Microsoft Visual Studio 2022 version 17.10 17.10.15; Microsoft Visual Studio 2022 version 17.13 17.13.7; Microsoft Visual Studio 2022 version 17.8 17.8.21; Microsoft Visual Studio 2022 version 17.14 17.12.8. Check the vendor advisory for mitigations.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646

Get alerted when CVE-2025-26646 or the next vulnerability affects your stack