EUVD-2026-73883
GHSA-8834-2x42-5wxx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered malicious file triggers the overflow (AV:N/PR:N), but developer must open it (UI:R); successful exploitation yields full code execution in user context (C:H/I:H/A:H, S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable by unauthenticated network-reachable attackers via a heap-based buffer overflow in the IDE, though user interaction is required to trigger the flaw. The CVSS score of 8.8 reflects the high impact potential - full compromise of confidentiality, integrity, and availability - moderated only by the need for a developer to open or process a crafted file. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | User interaction is required (CVSS UI:R): a targeted developer must open or load a specially crafted file within Visual Studio 2026 for the heap overflow to trigger - the vulnerability cannot be exploited passively or without this action. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately captures the threat profile: an unauthenticated attacker on any network can deliver a malicious payload, and the only meaningful friction is the UI:R requirement - the developer must open or process the crafted content. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to Microsoft Visual Studio 2026 version 18.9.3 or later, which is the fix boundary identified in EUVD-2026-73883; the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77906 provides the authoritative upgrade path and may cover additional affected branches. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of Visual Studio 2026 deployed across development teams and document which are running versions 18.9.0 through 18.9.2. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Visual Studio 2026
View allHeap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
HTTP request smuggling in System.Net.HttpListener across .NET 8.0, 9.0, and 10.0 enables unauthenticated remote attacker
Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable via a heap-based bu
Remote denial of service in ASP.NET Core enables unauthenticated network attackers to exhaust server resources and disru
Information disclosure in Windows Presentation Foundation (WPF) within .NET 8, 9, and 10 allows an unauthenticated netwo
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today