EUVD-2026-56679
GHSA-vg44-h755-9hw7
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector with user interaction (file-open pattern) aligns with PR:N trigger; full C/I/A impact justified by arbitrary code execution within process scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
AnalysisAI
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET release streams (8.0, 9.0, 10.0) and associated Visual Studio tooling. The flaw requires user interaction - consistent with a file-processing or input-parsing trigger - but no elevated privileges, meaning an attacker can exploit it by inducing a user to open or process a maliciously crafted artifact within a vulnerable .NET context. Full confidentiality, integrity, and availability compromise of the affected process is possible on successful exploitation. No public exploit identified at time of analysis and no CISA KEV listing; Microsoft has released patches across all affected branches.
Technical ContextAI
CWE-122 (Heap-based Buffer Overflow) describes a write operation that exceeds the allocated heap buffer boundary, overwriting adjacent heap metadata or object data. In managed runtimes like .NET, heap corruption of this class can bypass memory safety guarantees by corrupting internal runtime structures, object references, or native interop boundaries. The vulnerability spans .NET 8.0 (LTS), 9.0 (STS), and 10.0 (current), as well as the bundled runtimes embedded in Visual Studio 2022 (17.14 branch) and Visual Studio 2026 (18.8 branch). The breadth of affected versions suggests the flaw resides in a shared component - likely in a parser, codec, or native interop layer - present across the .NET SDK and runtime lineage. The 'Heap Overflow' and 'Buffer Overflow' tags from the EUVD corroborate the CWE-122 classification. The CVSS vector's local attack vector (AV:L) with user interaction (UI:R) and no required privileges (PR:N) is most consistent with a scenario in which a specially crafted file or data stream, when processed by a .NET application, corrupts heap memory during parsing or deserialization.
RemediationAI
Vendor-released patches are available for all affected release streams. Upgrade .NET 8.0 to version 8.0.30 or later, .NET 9.0 to 9.0.19 or later, and .NET 10.0 to 10.0.11 or later via the official .NET download page or NuGet package manager. Visual Studio 2022 users on the 17.14 branch should update to 17.14.38 or later; Visual Studio 2026 users on the 18.8 branch should update to 18.8.3 or later through Visual Studio's built-in update mechanism. The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62871 provides authoritative update guidance. If immediate patching is not possible, restricting user access to untrusted files processed by .NET applications - particularly in developer, CI/CD, or file-processing environments - reduces exposure. Blocking execution of untrusted .NET assemblies via AppLocker or WDAC policies can serve as a compensating control but may disrupt legitimate workflows and should be tested before deployment.
More in Visual Studio 2022
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove
Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Decompression bomb (CWE-409) in ASP.NET Core allows unauthenticated remote attackers to exhaust server resources and den
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today