CVE-2026-32178

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-138

Affected software

VendorProductVersions
Microsoft.NET 10.0>= 10.0.0, < 10.0.6
Microsoft.NET 8.0>= 8.0, < 8.0.26
Microsoft.NET 8.0>= 8.0.0, < 8.0.26
Microsoft.NET 9.0>= 9.0.0, < 9.0.15
MicrosoftMicrosoft Visual Studio 2022 version 17.12>= 17.12.0, < 17.12.19
MicrosoftMicrosoft Visual Studio 2022 version 17.14>= 17.14.0, < 17.14.30
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Hardened Images—
Red HatRed Hat Hardened Images—
Red HatRed Hat Hardened Images—

References

Timeline

Published
Apr 14, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-32184.8Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows CrosCVE-2026-321815.5Improper privilege management in Microsoft Windows allows an authorized attacker to deny service locally.CVE-2026-321837.8Improper neutralization of special elements used in a command ('command injection') in Windows Snipping Tool allows an unauthorized attackerCVE-2026-321847.8Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an authorized attacker to elevate privileges localCVE-2026-321855.5Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally.CVE-2026-321869.8Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a network.CVE-2026-321887.1Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2026-321897.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-32194.6pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior cCVE-2026-321908.4Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-321919.8Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized aCVE-2026-321927.8Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
CVE-2026-32178: High severity, CVSS 7.5 | Vulnix