EUVD-2026-73781
GHSA-4qhr-qf46-fcrx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious project file or .NET artifact
-
DeliveryDeliver via phishing or compromised package registry
-
ExploitVictim opens artifact in Visual Studio or automated build processes it
-
ExecutionHeap-based buffer overflow triggered in shared .NET component
-
ImpactArbitrary code execution in victim developer context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | User interaction is required: a victim must open or process attacker-controlled content - such as a project file, solution, build artifact, or NuGet package - using an unpatched version of Visual Studio 2022 (17.14.x before 17.14.40), Visual Studio 2026 (18.9.x before 18.9.3), or an affected .NET runtime or SDK (8.0.x before 8.0.31, 9.0.x before 9.0.20, 10.0.x before 10.0.12, or 11.0 pre-RC1). No authentication or elevated privileges are required on the attacker side (PR:N per CVSS). Fully automated zero-click network exploitation is not supported by the UI:R rating. However, CI/CD pipelines or build servers that automatically consume external packages without human review may reduce this interaction barrier in practice, as the 'user' interaction step is effectively automated by the build system. |
| Impact | The CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects high severity but not fully automatable exploitation: no credentials are required and the network attack vector enables broad delivery, yet a victim must actively interact with the malicious content. There is no CISA KEV listing and no public proof-of-concept identified, which tempers real-world urgency relative to the raw score; EPSS data was not present in available intelligence. The breadth of affected .NET versions across three LTS streams simultaneously means developer workstations and automated build infrastructure across a wide range of organizations are exposed - even a compact development team maintaining a multi-version .NET portfolio should treat this as a priority patch event. Patch availability from Microsoft significantly reduces residual risk for organizations that can apply updates promptly. |
| Exploit ScenarioDerived | An attacker crafts a malicious Visual Studio project file, .NET assembly, or NuGet package and distributes it via phishing, a compromised open-source repository, or a supply-chain vector. When a developer opens the artifact in an affected version of Visual Studio or triggers a build using an affected .NET SDK, the heap overflow fires and executes arbitrary code under the developer's account context. No public proof-of-concept has been identified, but the AC:L rating indicates a working exploit would not require sophisticated heap-layout manipulation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when a victim user interacts with attacker-supplied content, yielding full compromise of confidentiality, integrity, and availability. The vulnerability spans multiple .NET Long-Term Support and current release trains (8.0, 9.0, 10.0, 11.0), significantly broadening the attack surface beyond the IDE to include build servers and CI/CD pipelines ingesting .NET artifacts. Reported through Microsoft's MSRC channel (secure@microsoft.com) with a vendor patch now available; no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply vendor-released patches immediately: update Visual Studio 2026 to 18.9.3, Visual Studio 2022 to 17.14.40, .NET 8.0 to 8.0.31, .NET 9.0 to 9.0.20, .NET 10.0 to 10.0.12, and .NET 11.0 to RC1 or later as it becomes generally available. Guidance is provided in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-71328. Where immediate patching is not feasible, enforce policies that prevent developers from opening untrusted project files, solution archives, or NuGet packages sourced from outside verified repositories - this directly targets the UI:R interaction trigger. For CI/CD pipelines that automatically ingest external .NET artifacts, implement artifact signing verification and allowlisting to reduce the automated-processing attack surface. Note that blocking external artifact ingestion may impact build reproducibility workflows and should be tested against existing pipelines before broad deployment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-122 (Heap-based Buffer Overflow) arises when data written to a heap-allocated buffer exceeds its allocated bounds, corrupting adjacent allocations and potentially redirecting control flow to attacker-controlled memory. In the Visual Studio and .NET ecosystem, this class of vulnerability commonly surfaces during parsing of project files, solution artifacts, compiled assemblies, or NuGet package metadata. The cross-product impact spanning Visual Studio 2026 (18.9.x), Visual Studio 2022 (17.14.x), and .NET runtime releases 8.0.x through 11.0 pre-release strongly suggests the vulnerable code path resides in a shared .NET runtime or SDK component rather than in IDE-specific UI logic. EUVD-2026-73781 correlates this finding across the Microsoft product family.
Know when Visual Studio 2022 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network delivery requiring no privileges, low complexity once content is crafted, but active victim interaction to open content; full C/I/A loss on successful exploitation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
Technical POC Analysis
The advisory identifies the bug class as CWE-122 (Heap-based Buffer Overflow) in Microsoft.DiaSymReader.Native.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Microsoft Visual Studio 2022 and 2026 contain a critical vulnerability that enables remote code execution when developers interact with attacker-supplied content. No public exploit has been identified at the time of analysis, but the vulnerability affects development environments and CI/CD infrastructure across .NET versions 8.0 through 11.0, creating significant software supply chain risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Visual Studio 2022
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove
ASP.NET Core Kestrel request smuggling allows a low-privileged network attacker (PR:L, no user interaction) to desynchro
Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Exploit-DB