Description
A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles files.
Affected products
microsoft: visual studio 2022; microsoft: visual studio 2026; microsoft: .net; microsoft: windows
References1
- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32175 Vendor Advisory
Metrics
- CVSS 3.1
-
4.3
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - EPSS — exploit probability
- 1% percentile: 54 · as of 14 November 2026
- CWE
- CWE-36CWE-22
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.