The vulnerability is a tampering flaw in .NET Core that arises from improper handling of specially crafted files. An attacker who succeeds can cause the system to create or modify files and directories at certain locations, providing a limited ability to write arbitrary data. The flaw falls under CWE‑36, indicating a path traversal or related file‑system manipulation weakness.

The flaw affects Microsoft .NET 10.0, .NET 8.0, and .NET 9.0, as well as Microsoft Visual Studio 2017 versions 15.9 (15.0‑15.8), Visual Studio 2019 16.11 (16.0‑16.10), Visual Studio 2022 17.12 and 17.14, and Visual Studio 2026 18.5.

The CVSS score of 4.3 reflects a moderate severity because the attacker cannot freely choose all destination paths, but can still create or alter files in certain locations. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation data. To exploit the flaw, an attacker must send a specially crafted file to a vulnerable system—most likely via a file‑upload interface or by placing the file locally wherever the application processes it. Once the file reaches the system, the flaw allows the creation of arbitrary files or directories within limited bounds.