.NET Core CVE-2026-32175

The target system must be running Windows with an affected .NET runtime (8.0.0-8.0.26, 9.0.0-9.0.15, or 10.0.0-10.0.7); non-Windows platforms are explicitly excluded per the GHSA advisory. The attacker must be able to deliver a specially crafted file to a service or application that processes untrusted file input using the vulnerable runtime. Per the NVD CVSS vector (PR:L), some level of authentication may be required to reach the file processing endpoint, though the GHSA advisory vector (PR:N) suggests unauthenticated delivery may be possible - this discrepancy is unresolved and must be verified with Microsoft. The attacker's control over the write destination is explicitly described as limited, reducing but not eliminating the potential for impactful exploitation. The vulnerability does not affect Linux or macOS deployments.

Two conflicting CVSS 3.1 vectors exist in the source data and must be flagged: the NVD-recorded vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (score 4.3, requiring prior authentication and yielding limited integrity impact), while the GHSA advisory published by Microsoft records AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (unauthenticated, high integrity impact, implying a score closer to 7.5). This discrepancy is material - security teams should consult the Microsoft MSRC advisory directly to confirm the authoritative vector before triaging. Regardless of which vector applies, EPSS at 0.08% (23rd percentile) and SSVC exploitation status of 'none' suggest low real-world exploitation pressure. The public POC raises the urgency slightly but does not change the SSVC 'not automatable' assessment. The 'limited control over destination' language in the description aligns with I:L rather than I:H, making the NVD scoring more consistent with the described impact, though the vendor-side GHSA may reflect a worst-case scenario assessment.

An attacker submits a specially crafted archive or file (such as a malicious ZIP or tar) to a .NET web application or file-processing service running on Windows. The path traversal flaw causes the runtime to write the file's contents to a location outside the intended target directory - for example, dropping a file into a startup directory or overwriting an application configuration file. A public proof-of-concept is available at https://gist.github.com/alon710/261ffaf79cb2412380434d62f37902b8, lowering the technical bar for exploitation.