EUVD-2026-73170
GHSA-2j8r-3c22-8565
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered via malicious file, no attacker privileges required, but victim must open content; full triad impact on successful exploitation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
5DescriptionCVE.org
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
AnalysisAI
Heap-based buffer overflow in Microsoft Visual Studio and .NET affects multiple release branches and allows a remote unauthenticated attacker to execute arbitrary code on a victim's machine when the victim interacts with malicious content. Affected scope spans Visual Studio 2022 (17.14.x), Visual Studio 2026 (18.9.x), and the full current .NET runtime family (8.0, 9.0, 10.0, 11.0 RC1) as well as legacy .NET Framework branches from 3.5 through 4.8.1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a victim user actively opens or processes a specially crafted file using an affected version of Visual Studio 2022 (< 17.14.40), Visual Studio 2026 (< 18.9.3), or a .NET SDK/runtime in the affected version ranges (see affected_products). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score reflects a meaningful real-world threat: network delivery (AV:N), low complexity (AC:L), no required privileges (PR:N), and full triad impact (C:H/I:H/A:H) are all high-severity signals. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Microsoft has released patches for all affected product branches. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: notify security, development, and infrastructure teams of this HIGH severity vulnerability; inventory all instances of Visual Studio 2022 (17.14.x), Visual Studio 2026 (18.9.x), .NET Runtime (8.0, 9.0, 10.0, 11.0 RC1), and .NET Framework (3.5-4.8.1) in your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today