Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe security advisory for CVE-2025-55247 explicitly states that the vulnerability lies in how MSBuild handles predictable temporary directory paths on Linux, and that projects not using the 'DownloadFile' build task are unaffected. This strongly indicates that the 'DownloadFile' task is the entry point for the vulnerability. My analysis of the 'DownloadFile.cs' source code reveals that the 'DownloadAsync' method uses 'Directory.CreateDirectory' with a user-provided, predictable path ('DestinationFolder.ItemSpec'). This creates a classic Time-of-Check-to-Time-of-Use (TOCTOU) race condition. An attacker can create a symbolic link or a file at the destination path before the build process, causing the directory creation or the subsequent file write to fail, leading to a Denial of Service. The vulnerable functions identified are the core methods involved in executing the 'DownloadFile' task, with 'DownloadAsync' containing the specific flawed logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.Build.Tasks.Core | nuget | = 17.15.0-preview-25277-114 | 18.0.0-preview-25476-107 |
| Microsoft.Build.Tasks.Core | nuget | >= 17.14.0, <= 17.14.8 | 17.14.28 |
| Microsoft.Build.Tasks.Core | nuget | >= 17.12.0, <= 17.12.36 | 17.12.50 |
| Microsoft.Build.Tasks.Core | nuget | >= 17.11.0, <= 17.11.31 | 17.11.48 |
| Microsoft.Build.Tasks.Core | nuget | >= 17.10.0, <= 17.10.29 | 17.10.46 |
| Microsoft.Build.Tasks.Core | nuget | >= 17.8.0, <= 17.8.29 | 17.8.43 |
| Microsoft.Build | nuget | = 17.15.0-preview-25277-114 | 18.0.0-preview-25476-107 |
| Microsoft.Build | nuget | >= 17.14.0, <= 17.14.8 | 17.14.28 |
| Microsoft.Build | nuget | >= 17.12.0, <= 17.12.36 | 17.12.50 |
| Microsoft.Build | nuget | >= 17.11.0, <= 17.11.31 | 17.11.48 |
| Microsoft.Build | nuget | >= 17.10.0, <= 17.10.29 | 17.10.46 |
| Microsoft.Build | nuget | >= 17.8.0, <= 17.8.29 | 17.8.43 |
| Microsoft.Build.Utilities.Core | nuget | = 17.15.0-preview-25277-114 | 18.0.0-preview-25476-107 |
| Microsoft.Build.Utilities.Core | nuget | >= 17.14.0, <= 17.14.8 | 17.14.28 |
| Microsoft.Build.Utilities.Core | nuget | >= 17.12.0, <= 17.12.36 | 17.12.50 |
| Microsoft.Build.Utilities.Core | nuget | >= 17.11.0, <= 17.11.31 | 17.11.48 |
| Microsoft.Build.Utilities.Core | nuget | >= 17.10.0, <= 17.10.29 | 17.10.46 |
| Microsoft.Build.Utilities.Core | nuget | >= 17.8.0, <= 17.8.29 | 17.8.43 |
