Skip to content
OpenAdvisories
High MSRC-CVE-2025-26646 1 CVE

.NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability

Published May 13, 2025 · Updated May 22, 2025 · Revision 2

Vendor: Microsoft

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

Details

According to the CVSS metric, user interaction is required (UI:R) and privileges required  is low (PR:L). What does that mean for this vulnerability?
An authorized attacker with standard user privileges could place a malicious file and then wait for the privileged victim to run the calling command.

Security updates
8.0.16 — https://support.microsoft.com/help/5059200
9.0.5 — https://support.microsoft.com/help/5059201
17.12.8 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes

Vulnerabilities 1

Revision history

  1. #2

    To comprehensively address CVE-2025-26646, Microsoft has released security updates on May 22, 2025 for Visual Studio 2022 version 17.10. In addition, updates .NET 8.0.313 and .NET 8.0.410 have been released for .NET SDKs 8.0.3xx and 8.0.4xx, respectively. For more information about the .NET updates see [KB5059200](https://support.microsoft.com/en-us/topic/-net-8-0-update-may-22-2025-kb5059200-8ace2b08-2644-454e-a43f-157c60835e49). Microsoft recommends customers to install these updates to be fully protected from the vulnerability.

  2. #1

    Information published.

References