VYPR
← All advisories
High severityNVD Advisory· Published May 13, 2025· Updated Feb 26, 2026

.NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability

CVE-2025-26646

Description

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2025-26646 is a spoofing vulnerability in .NET, Visual Studio, and Build Tools where external control of file names or paths via the DownloadFile build task allows an authorized attacker to perform network-based spoofing.

Vulnerability

Overview

CVE-2025-26646 is a spoofing vulnerability in .NET SDK, Visual Studio, and Build Tools for Visual Studio, stemming from external control of file names or paths. The vulnerability resides in the Microsoft.Build.Tasks.Core package, specifically in the DownloadFile build task. An attacker who can influence the file name or path used by a build process can cause the system to operate on an unintended file, leading to spoofing attacks over a network [2][3].

Exploitation

Conditions

An attacker must be an authorized user or have the ability to influence a build process that uses the DownloadFile task. Projects that do not use this task are not susceptible [2][4]. The vulnerability is triggered when an attacker can control the destination file path for a download, allowing them to redirect the output to a location that may be misinterpreted by the system or user, thereby spoofing legitimate content or behavior.

Impact

Successful exploitation enables an authorized attacker to perform spoofing, which could lead to a variety of attacks including credential theft, malicious file execution, or supply-chain compromise. The vulnerability is rated with CVSS 4.0 metrics as not yet provided by NVD, but the advisory highlights the serious nature of spoofing in development and build environments [1][2].

Mitigation and

Patching

Microsoft has released patches for the affected software. Developers are advised to update to the latest .NET SDK versions (9.0.105+, 8.0.115+, etc.) and update the Microsoft.Build.Tasks.Core package to the patched versions listed in the advisory [2][3][4]. Visual Studio will prompt users to update to the patched SDKs. There is no workaround other than not using the vulnerable DownloadFile task.

References
  1. NVD - CVE-2025-26646
  2. Microsoft Security Advisory CVE-2025-26646: .NET Spoofing Vulnerability
  3. Microsoft Security Advisory CVE-2025-26646: .NET Spoofing Vulnerability
  4. Microsoft Security Advisory CVE-2025-26646: .NET Spoofing Vulnerability

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.Build.Tasks.CoreNuGet
>= 15.8.166, < 15.9.3015.9.30
Microsoft.Build.Tasks.CoreNuGet
>= 16.0.461, < 16.11.616.11.6
Microsoft.Build.Tasks.CoreNuGet
>= 17.0.0, < 17.8.2917.8.29
Microsoft.Build.Tasks.CoreNuGet
>= 17.9.5, < 17.10.2917.10.29
Microsoft.Build.Tasks.CoreNuGet
>= 17.11.4, < 17.12.3617.12.36
Microsoft.Build.Tasks.CoreNuGet
>= 17.12.6, < 17.13.2617.13.26
Microsoft.Build.Tasks.CoreNuGet
>= 17.13.9, < 17.14.817.14.8

Affected products

85

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.