CVE-2026-32175: .NET Core RCE Vulnerability

CVE-2026-32175 Overview

CVE-2026-32175 is a tampering vulnerability in .NET Core caused by improper handling of specially crafted files. An authenticated attacker who exploits this flaw can write arbitrary files and directories to certain locations on a vulnerable system. The attacker has limited control over the destination paths, which constrains the impact. Exploitation requires sending a specially crafted file to the vulnerable system. Microsoft addressed the flaw through a security update that corrects how .NET Core processes the affected file inputs. The issue is tracked under [CWE-36: Absolute Path Traversal].

Critical Impact
Successful exploitation allows arbitrary file and directory writes on the target system, potentially enabling tampering with application data or configuration files.

Affected Products

Microsoft .NET Core (versions specified in the Microsoft advisory)
Applications built on the affected .NET Core runtime
Systems processing untrusted file inputs through .NET Core APIs

Discovery Timeline

2026-05-12 - CVE-2026-32175 published to the National Vulnerability Database
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-32175

Vulnerability Analysis

The vulnerability resides in the file handling logic within .NET Core. When the runtime processes a specially crafted file, it fails to enforce proper path constraints. This allows an attacker to influence where files and directories are written on disk. The classification under [CWE-36: Absolute Path Traversal] indicates that absolute path components in attacker-supplied input are not adequately sanitized.

The attack vector is network-based and requires low privileges on the system. No user interaction is necessary. The impact is limited to integrity, as the flaw permits unauthorized writes but does not directly expose data or disrupt availability. The attacker's control over the final destination is constrained, reducing the chance of arbitrary code execution through this primitive alone.

Root Cause

The root cause is insufficient validation of file path data within crafted file inputs processed by .NET Core. The runtime trusts path elements that should be sanitized or rejected. As a result, file write operations resolve to locations outside the intended directory boundary.

Attack Vector

An attacker submits a specially crafted file to an application that processes it through the vulnerable .NET Core code path. The runtime extracts or interprets path information embedded in the file and writes content to a location chosen by the attacker, within the limits noted in the advisory. The Microsoft advisory for CVE-2026-32175 provides authoritative technical details and affected build numbers.

No public proof-of-concept code has been released for this issue, and no verified exploit examples are available at the time of publication.

Detection Methods for CVE-2026-32175

Indicators of Compromise

Unexpected files or directories appearing in system or application directories following the processing of user-supplied files
.NET Core processes writing to paths outside their expected working directories
Application logs showing file unpacking or extraction operations referencing absolute paths or parent directory traversal sequences

Detection Strategies

Monitor file system telemetry for write operations originating from dotnet.exe or hosted .NET Core processes targeting locations outside the application sandbox
Inspect web application and API logs for uploaded files containing crafted path metadata, such as archive entries with absolute paths
Correlate process lineage of .NET Core workers with subsequent file creation events in sensitive directories

Monitoring Recommendations

Enable file integrity monitoring on application installation directories, scheduled task folders, and web roots that host .NET Core services
Audit authentication events preceding file upload activity, since exploitation requires low-privilege authenticated access
Track .NET Core runtime version inventory across endpoints and servers to identify unpatched hosts

How to Mitigate CVE-2026-32175

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-32175 Advisory to all systems running affected .NET Core versions
Inventory applications that accept file uploads or process external files through .NET Core APIs and prioritize patching those hosts
Restrict file upload functionality to authenticated users with the minimum necessary privileges until patching completes

Patch Information

Microsoft has released a security update that fixes the vulnerability by ensuring .NET Core properly handles files. Administrators should install the runtime update on all affected hosts and redeploy self-contained applications that bundle a vulnerable .NET Core runtime. Refer to the Microsoft Security Response Center advisory for the specific package versions and KB identifiers.

Workarounds

Validate and normalize file paths in application code before passing content to .NET Core extraction or file-write APIs
Reject input archives or files containing absolute paths or parent directory references (..) at the application layer
Run .NET Core services under least-privilege accounts with write access limited to required directories

bash

# Verify installed .NET Core runtime versions
dotnet --list-runtimes

# Example: enforce restricted write permissions for the service account
icacls "C:\inetpub\wwwroot\app" /inheritance:r /grant:r "AppPoolUser:(OI)(CI)RX"