The vulnerability is a tampering flaw in .NET Core that arises from improper handling of specially crafted files. An attacker who succeeds can cause the system to create or modify files and directories at certain locations, providing a limited ability to write arbitrary data. The flaw falls under CWE‑22 and CWE‑36, indicating path traversal and file‑system manipulation weaknesses.

The flaw affects Microsoft .NET 10.0, .NET 8.0, and .NET 9.0, as well as Microsoft Visual Studio 2022 version 17.12, 17.14, and Microsoft Visual Studio 2026 version 18.5.

The CVSS score of 4.3 reflects a moderate severity because the attacker cannot freely choose all destination paths, but can still create or alter files in certain locations. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a very low but not zero probability of exploitation. The likely attack vector is sending a specially crafted file to a vulnerable system, for example via a file‑upload endpoint. Once the file reaches the system, the flaw allows the creation of arbitrary files or directories within limited bounds.