4.3Media

CVE-2026-32175.NET Core Tampering Vulnerability

Microsoft .NET 10.0; Microsoft .NET 8.0; Microsoft .NET 9.0; Microsoft Microsoft Visual Studio 2022 version 17.12 Publicada: (hace 6 meses)

Descripción

A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles files.

Debilidad (CWE): CWE-36CWE-22

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
Microsoft Microsoft Visual Studio 2022 version 17.12 17.12.0 – < 17.12.20
Microsoft Microsoft Visual Studio 2022 version 17.14 17.14.0 – < 17.14.32
Microsoft Microsoft Visual Studio 2026 version 18.5 18.5.0 – < 18.5.3
microsoft .net 10.0.0 – < 10.0.8
Microsoft .NET 10.0 10.0.0 – < 10.0.8
Microsoft .NET 8.0 8.0.0 – < 8.0.27
Microsoft .NET 9.0 9.0.0 – < 9.0.16
microsoft visual studio 2022 17.14.0 – < 17.14.32
microsoft visual studio 2026 18.5.0 – < 18.5.3

Referencias y parches

Coincidencias CPE (NVD) (5)

  • cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* ≥ 17.12.0 < 17.12.20
  • cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* ≥ 17.14.0 < 17.14.32
  • cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:* ≥ 18.5.0 < 18.5.3
  • cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* ≥ 8.0.0 < 8.0.27
  • cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* ≥ 9.0.0 < 9.0.16