CVE-2026-45491: Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Formats.Tar. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A tampering vulnerability exists in the TarFile.ExtractToDirectory method where a symlink path traversal enables an attacker to perform arbitrary file writes outside the intended extraction directory.