CVE-2026-32175

CVE-2026-32175 is a medium-severity vulnerability in Microsoft Visual Studio 2022 with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-22.

Key facts

Description

A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles files.

Frequently asked questions

What is CVE-2026-32175?
A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles files.
How severe is CVE-2026-32175?
CVE-2026-32175 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2026-32175 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-32175?
CVE-2026-32175 primarily affects Microsoft Visual Studio 2022. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-32175?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-32175 have an EU (EUVD) identifier?
Yes. CVE-2026-32175 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-29571.
When was CVE-2026-32175 published?
CVE-2026-32175 was published on 2026-05-12 and last updated on 2026-06-18.

References

Affected products (3)

More vulnerabilities in Microsoft Visual Studio 2022

All CVEs affecting Microsoft Visual Studio 2022 →

Other CWE-22 (Path Traversal) vulnerabilities

Browse all CWE-22 (Path Traversal) vulnerabilities →