« Volver al listado

CVE-2026-32175

Estado: AnalizadaMedia (4.3)—

A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles files.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Microsoft — .netMicrosoft — Visual Studio 2022Microsoft — Visual Studio 2026

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-32175",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-32175",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-12T19:22:38.751667Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": ".NET 10.0",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.0",
              "lessThan": "10.0.8",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": ".NET 8.0",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0",
              "lessThan": "8.0.27",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": ".NET 9.0",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.0",
              "lessThan": "9.0.16",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Visual Studio 2022 version 17.12",
          "versions": [
            {
              "status": "affected",
              "version": "17.12.0",
              "lessThan": "17.12.20",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Visual Studio 2022 version 17.14",
          "versions": [
            {
              "status": "affected",
              "version": "17.14.0",
              "lessThan": "17.14.32",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Visual Studio 2026 version 18.5",
          "versions": [
            {
              "status": "affected",
              "version": "18.5.0",
              "lessThan": "18.5.3",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-12T18:16:58.737",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32175",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@microsoft.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-36"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories.\nTo exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system.\nThe security update fixes the vulnerability by ensuring .NET Core properly handles files."
    }
  ],
  "lastModified": "2026-06-18T17:29:32.797",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84C9D69D-F0FC-465F-94B8-832EB58B6788",
              "versionEndExcluding": "17.12.20",
              "versionStartIncluding": "17.12.0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "450E6D45-68A5-4C90-869C-20A314303B12",
              "versionEndExcluding": "17.14.32",
              "versionStartIncluding": "17.14.0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6538F8A2-3412-4A67-98DC-CD3A7BC4117E",
              "versionEndExcluding": "18.5.3",
              "versionStartIncluding": "18.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22FEE1A6-0E92-4E1A-B3C0-AD8DF6EE7B7B",
              "versionEndExcluding": "8.0.27",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F144BCB-8CEA-451A-9048-2A706EA67262",
              "versionEndExcluding": "9.0.16",
              "versionStartIncluding": "9.0.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}