EUVD-2026-44356
GHSA-5q8c-4c69-36xr
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local IDE flaw requiring the victim to open crafted content (AV:L, UI:R) with no prior privileges (PR:N), yielding full local code execution and high C/I/A in an unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Visual Studio (2022 versions 17.12 and 17.14, and 2026 version 18.7) stems from a protection mechanism failure that lets an unauthorized attacker run arbitrary code once a victim is convinced to open or interact with a malicious project, file, or solution. Microsoft has published a fix, but there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. The CVSS 3.1 base score is 7.8, reflecting high confidentiality, integrity, and availability impact requiring local access plus user interaction.
Technical ContextAI
Visual Studio is Microsoft's flagship integrated development environment for building .NET, C++, web, and cloud applications, widely used on developer workstations and build agents. The root cause is CWE-693 (Protection Mechanism Failure), meaning a built-in security control - the vendor's supplied tags describe it as an Authentication Bypass - fails to enforce its intended trust boundary, allowing untrusted code or content processed by the IDE to bypass safeguards and execute. The affected CPEs precisely identify microsoft:microsoft_visual_studio_2022_version_17.12, microsoft_visual_studio_2022_version_17.14, and microsoft_visual_studio_2026_version_18.7, indicating the defect spans both the 2022 servicing branches and the newer 2026 release rather than a single build.
RemediationAI
Patch available per vendor advisory: apply the servicing update for your channel from the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47305, which covers Visual Studio 2022 17.12, 2022 17.14, and 2026 18.7 - install the update through the Visual Studio Installer or your managed update process and confirm the build number matches the advisory's fixed version. Until patched, reduce exposure by treating untrusted solutions, projects, and source files as hostile: do not open repositories, .sln/.csproj, or downloaded samples from untrusted origins, and disable automatic project/asset loading and 'Trust' prompts so no build or restore action runs on open. Isolate developer machines and build agents that cannot be immediately updated (restricted network segment, least-privilege service accounts) to limit blast radius; the trade-off is added friction opening legitimate external repos, which is acceptable given the code-execution impact.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Security feature bypass in Microsoft .NET (shipped via Visual Studio 2022 17.12/17.14 and Visual Studio 2026 18.7) lets
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Local code execution in Microsoft .NET (Framework 3.5 through 4.8.1, .NET 8.0/9.0, and Visual Studio 2022/2026) arises f
Local code execution in Microsoft .NET 8.0 and 9.0 (and bundled Visual Studio 2022/2026 toolchains) arises from unsafe d
Local privilege elevation in Microsoft .NET Framework (and .NET 8.0/9.0 plus Visual Studio 2022/2026) via code injection
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today