Most recent entries from all

ALSA-2025:7571 — Important: .NET 9.0 security update

Affected: AlmaLinux:8: aspnetcore-runtime-9.0, AlmaLinux:8: aspnetcore-runtime-dbg-9.0, AlmaLinux:8: aspnetcore-targeting-pack-9.0, AlmaLinux:8: dotnet, AlmaLinux:8: dotnet-apphost-pack-9.0, AlmaLinux:8: dotnet-host, AlmaLinux:8: dotnet-hostfxr-9.0, AlmaLinux:8: dotnet-runtime-9.0, AlmaLinux:8: dotnet-runtime-dbg-9.0, AlmaLinux:8: dotnet-sdk-9.0 and 6 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.106 and .NET Runtime 9.0.5.Security Fix(es):

* dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-05444

BELL-CVE-2025-26646

Affected: Alpaquita:stream: dotnet8-runtime

BIT-dotnet-2025-26646 — .NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability

Affected: Bitnami: dotnet

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.

certfr-2025-avi-0405 — De multiples vulnérabilités ont été découvertes dans Microsoft Windows. Certaines d'entre elles permettent à un attaqua…

certfr-2025-avi-0405

EUVD-2026-272976

fkie_cve-2025-26646

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.

GHSA-h4j7-5rxr-p4wc — Microsoft.Build.Tasks.Core .NET Spoofing Vulnerability

Affected: NuGet: Microsoft.Build.Tasks.Core

# Microsoft Security Advisory CVE-2025-26646: .NET Spoofing Vulnerability

## <a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0.xxx and .NET 8.0.xxx SDK. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.

A vulnerability exists in .NET SDK or MSBuild applications where external control of file name or path allows an unauthorized attacked to perform spoofing over a network.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/356

### <a name="mitigation-factors"></a>Mitigation factors

Projects which do not utilize the [DownloadFile](https://learn.microsoft.com/visualstudio/msbuild/downloadfile-task) build task are not susceptible to this vulnerability.

## <a name="affected-software"></a>Affected software

* Any installation of .NET 9.0.105 SDK, .NET 9.0.203 SDK or earlier. * Any installation of .NET 8.0.115 SDK, .NET 8.0.311 or .NET 8.0.312 SDK, .NET 8.0.408 or .NET 8.0.409 SDK or earlier.

## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.Build.Tasks.Core](https://www.nuget.org/packages/Microsoft.Build.Tas…

msrc_CVE-2025-26646 — .NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability

msrc_CVE-2025-26646

RHSA-2025:7571 — Red Hat Security Advisory: .NET 9.0 security update

dotnet: .NET and Visual Studio Spoofing Vulnerability

RHSA-2025:7599 — Red Hat Security Advisory: .NET 8.0 security update

dotnet: .NET and Visual Studio Spoofing Vulnerability

UBUNTU-CVE-2025-26646

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet8, Ubuntu:25.10: dotnet8, Ubuntu:25.10: dotnet9

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.

WID-SEC-W-2025-1015 — Microsoft Developer Tools: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio, Microsoft Visual Studio Code, Microsoft Azure DevOps und Microsoft .NET Framework ausnutzen, um seine Privilegien zu eskalieren, Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, beliebigen Programmcode auszuführen oder Daten zu manipulieren.