Is CVE-2026-32178 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32178 being exploited in the wild.

How severe is CVE-2026-32178?

High severity, with a CVSS score of 7.5, published 14 April 2026.

How is CVE-2026-32178 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-32178?

Check whether you run Microsoft .NET Core Runtime, Microsoft.NetCore.App.Runtime.linux-arm (NuGet), Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32178: Microsoft .NET SMTP command injection in MailAddress parsing

CVE-2026-32178 · Severity: high · CVSS 7.5 · Published 2026-04-14

A vulnerability in the Microsoft .NET framework could allow an unauthorized attacker to spoof communications over a network. .NET is a widely used software framework for building and running applications on Windows and Linux. An exploit could allow an attacker to inject malicious commands or headers into emails sent by affected applications, potentially leading to unauthorized data access or reputation damage through fraudulent messaging.

Quick answers

Is CVE-2026-32178 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32178 being exploited in the wild.
How severe is CVE-2026-32178?: High severity, with a CVSS score of 7.5, published 14 April 2026.
Which products and versions are affected?: Microsoft .NET Core Runtime 8.0.0 - 8.0.25, 9.0.0 - 9.0.14, 10.0.0 - 10.0.5; Microsoft.NetCore.App.Runtime.linux-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.6; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.6; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.6; and 11 more.
Is there a fix for CVE-2026-32178?: Yes. Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.6 or later; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.6 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.6 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.6 or later; Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.6 or later; Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.6 or later; Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.6 or later; Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.6 or later; Microsoft.NetCore.App.Runtime.win-arm (NuGet): upgrade to 10.0.6 or later; Microsoft.NetCore.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.6 or later; Microsoft.NetCore.App.Runtime.win-x64 (NuGet): upgrade to 10.0.6 or later; Microsoft.NetCore.App.Runtime.win-x86 (NuGet): upgrade to 10.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32178 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-32178?: Check whether you run Microsoft .NET Core Runtime, Microsoft.NetCore.App.Runtime.linux-arm (NuGet), Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-arm --version 10.0.6

Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-arm64 --version 10.0.6

Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm --version 10.0.6

Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm64 --version 10.0.6

Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-x64 --version 10.0.6

Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-x64 --version 10.0.6

Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.NetCore.App.Runtime.osx-arm64 --version 10.0.6

Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.NetCore.App.Runtime.osx-x64 --version 10.0.6

Microsoft.NetCore.App.Runtime.win-arm (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.NetCore.App.Runtime.win-arm --version 10.0.6

Microsoft.NetCore.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.NetCore.App.Runtime.win-arm64 --version 10.0.6

Microsoft.NetCore.App.Runtime.win-x64 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.NetCore.App.Runtime.win-x64 --version 10.0.6

Microsoft.NetCore.App.Runtime.win-x86 (NuGet): upgrade to 10.0.6 or later

dotnet add package Microsoft.NetCore.App.Runtime.win-x86 --version 10.0.6

Technical details

A vulnerability exists in the .NET MailAddress parsing logic (CWE-138) where special elements are not properly neutralized. This flaw allows a remote, unauthenticated attacker to perform SMTP command injection and header injection by providing specially crafted input to applications that use the affected .NET components for email functionality. Successful exploitation could allow an attacker to manipulate email metadata or inject arbitrary SMTP commands. The issue affects .NET 8.0 and 9.0, and patches have been released by Microsoft and Red Hat (e.g., .NET SDK 9.0.116 and 8.0.126).

Affected products

Microsoft .NET 8.0, 9.0
Red Hat Red Hat Enterprise Linux AppStream 8, 9, 10.1
Red Hat Red Hat Enterprise Linux AppStream EUS 9.4, 9.6, 10.0

Identifiers

CVE-2026-32178
GHSA-vmwf-m9c5-3jvc

Timeline

2026-04-14: disclosed
2026-05-04: patched: Red Hat released security updates (RHSA-2026:13280, RHSA-2026:13281)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.