EUVD-2026-73293
GHSA-47px-wrj6-fwj9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered file triggers heap overflow with no auth (PR:N), but victim must open it (UI:R); full C/I/A impact consistent with code execution in user context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable via a heap-based buffer overflow triggered when a victim opens a specially crafted file. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates unauthenticated network-reachable exploitation requiring only that the target developer open an attacker-supplied artifact - a realistic social-engineering scenario in development environments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | User interaction is required: the victim must actively open a specially crafted file within Visual Studio 2026 (versions 18.9.0-18.9.2). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 8.8 with AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H places this in the High severity tier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Microsoft Visual Studio 2026 to version 18.9.3 or later, which is the vendor-released patch per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77907. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Visual Studio 2026 versions 18.9.0 through 18.9.2 using endpoint monitoring or asset inventory tools, and notify affected development teams of the vulnerability and exploitation vector. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Visual Studio 2026
View allHeap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
HTTP request smuggling in System.Net.HttpListener across .NET 8.0, 9.0, and 10.0 enables unauthenticated remote attacker
Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable by unauthenticated
Remote denial of service in ASP.NET Core enables unauthenticated network attackers to exhaust server resources and disru
Information disclosure in Windows Presentation Foundation (WPF) within .NET 8, 9, and 10 allows an unauthenticated netwo
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today