Junglewise Threat Intelligence

CVE-2026-32178: Microsoft .NET SMTP command injection in MailAddress parsing

CVE-2026-32178 · Severity: high · CVSS 7.5 · Published 2026-04-14

Technologies: Red Hat Enterprise Linux AppStream, Microsoft .NET Core Runtime, Red Hat Enterprise Linux AppStream EUS. Vendors: Red Hat, Microsoft.

Executive brief

A vulnerability in the Microsoft .NET framework could allow an unauthorized attacker to spoof communications over a network. .NET is a widely used software framework for building and running applications on Windows and Linux. An exploit could allow an attacker to inject malicious commands or headers into emails sent by affected applications, potentially leading to unauthorized data access or reputation damage through fraudulent messaging.

Technical details

A vulnerability exists in the .NET MailAddress parsing logic (CWE-138) where special elements are not properly neutralized. This flaw allows a remote, unauthenticated attacker to perform SMTP command injection and header injection by providing specially crafted input to applications that use the affected .NET components for email functionality. Successful exploitation could allow an attacker to manipulate email metadata or inject arbitrary SMTP commands. The issue affects .NET 8.0 and 9.0, and patches have been released by Microsoft and Red Hat (e.g., .NET SDK 9.0.116 and 8.0.126).

Affected products

  • Microsoft .NET 8.0, 9.0
  • Red Hat Red Hat Enterprise Linux AppStream 8, 9, 10.1
  • Red Hat Red Hat Enterprise Linux AppStream EUS 9.4, 9.6, 10.0

Timeline

  • 2026-04-14: disclosed
  • 2026-05-04: patched: Red Hat released security updates (RHSA-2026:13280, RHSA-2026:13281)

References

Related threats