This vulnerability (CVE-2026-32178) in the .NET runtime's System.Net.Mail component arises from improper neutralization of special elements, specifically carriage return and line feed (CR/LF) sequences, during email address parsing. An attacker can exploit this flaw to inject additional SMTP headers or commands, enabling spoofing attacks by altering the structure of email messages. The issue impacts confidentiality by potentially exposing sensitive email content to unauthorized recipients. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low complexity, and no privileges or user interaction required. Microsoft has issued an official fix for this vulnerability. Red Hat's advisory confirms the impact on their products using the affected .NET runtime and recommends applying security updates once available.

The vulnerability allows unauthorized attackers to perform email spoofing by injecting SMTP commands or headers through specially crafted email address input. This can lead to the alteration of email message structure and potential exposure of sensitive information to unintended recipients. The impact is limited to confidentiality; integrity and availability are not affected. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft for this vulnerability. Red Hat advises customers to apply the relevant security updates when they become available. There is no known practical temporary workaround that fully mitigates this issue. Users should monitor vendor advisories and update affected .NET runtime components promptly to remediate the vulnerability.