EUVD-2026-29571
GHSA-rg75-q538-x34v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network delivery of a crafted file requires no prior auth; 'limited destination control' supports I:L over I:H despite GHSA claiming otherwise.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles files.
AnalysisAI
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible attacker to write arbitrary files and directories to restricted locations on a vulnerable system by sending a specially crafted file. Exploitation is constrained by limited attacker control over the write destination, and SSVC assessment rates exploitation as 'none' with non-automatable impact, consistent with the low EPSS of 0.08%. A publicly available proof-of-concept exists on GitHub Gist, but no confirmed active exploitation appears in CISA KEV; patched runtime versions are available for all affected .NET branches.
Technical ContextAI
CWE-36 (Absolute Path Traversal) is the root cause: .NET Core's file-handling logic fails to sanitize absolute path components in specially crafted input files, allowing path components to escape the intended write directory. The flaw is confined to Windows runtime packages - CPE strings confirm only win-arm, win-arm64, win-x64, and win-x86 variants of Microsoft.NetCore.App.Runtime are affected across .NET 8.0, 9.0, and 10.0. Visual Studio 2017 through 2026 are also listed as affected because they bundle or reference the vulnerable .NET runtime packages. The GHSA advisory (GHSA-rg75-q538-x34v) explicitly scopes impact to the Windows platform across all architectures.
RemediationAI
Upgrade affected .NET runtimes to the patched versions released by Microsoft: .NET 8.0.27, .NET 9.0.16, and .NET 10.0.8, available via NuGet (e.g., Microsoft.NetCore.App.Runtime.win-x64) and the standard .NET update channel. For Visual Studio, update to version 15.9.80 (VS 2017), 16.11.56 (VS 2019), 17.12.20 or 17.14.31 (VS 2022), or 18.5.3 (VS 2026) through the Visual Studio Installer. Full patching guidance is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32175 and the dotnet announcements issue at https://github.com/dotnet/announcements/issues/396. If immediate patching is not feasible, consider restricting network access to services that process untrusted file uploads and validating file paths server-side before any write operation; note that application-layer mitigations may be incomplete given the traversal occurs at the runtime level.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same weakness CWE-36 – Absolute Path Traversal
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today