.NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2025-26646 · CVE overview and exploitation status

EUVD-2025-14511

GHSA-h4j7-5rxr-p4wc

BIT-dotnet-2025-26646

BIT-dotnet-sdk-2025-26646

cve-program · CVE-2025-26646

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646

euvd · EUVD-2025-14511

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646

nvd · CVE-2025-26646

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646

osv · GHSA-h4j7-5rxr-p4wc

• https://github.com/dotnet/msbuild/security/advisories/GHSA-h4j7-5rxr-p4wc
• https://nvd.nist.gov/vuln/detail/CVE-2025-26646
• https://github.com/dotnet/announcements/issues/356
• https://github.com/dotnet/msbuild/issues/11846
• https://github.com/dotnet/msbuild
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646

• External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network. · Advisory content revised · 9 Nov 2026