CVE-2026-32178 — .NET Spoofing Vulnerability

Description (CNA)

No English CNA description was supplied.

Affected (CNA)

Vendor / product	Versions
Microsoft / .NET 10.0	affected 10.0.0 before 10.0.6
Microsoft / .NET 8.0	affected 8.0 before 8.0.26
Microsoft / .NET 8.0	affected 8.0.0 before 8.0.26
Microsoft / .NET 9.0	affected 9.0.0 before 9.0.15
Microsoft / Microsoft Visual Studio 2022 version 17.12	affected 17.12.0 before 17.12.19
Microsoft / Microsoft Visual Studio 2022 version 17.14	affected 17.14.0 before 17.14.30

CWE

CWE-138

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32178

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in the .NET runtime (System.Net.Mail) in how email address data is parsed. Improper neutralization of special characters, specifically carriage return and line feed (CR/LF) sequences, may allow specially crafted email address input to be interpreted incorrectly. An attacker could exploit this issue to perform email spoofing by injecting additional headers or altering how the email address is processed during SMTP operations