EUVD-2026-73781
GHSA-4qhr-qf46-fcrx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network delivery requiring no privileges, low complexity once content is crafted, but active victim interaction to open content; full C/I/A loss on successful exploitation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
5DescriptionCVE.org
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
AnalysisAI
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when a victim user interacts with attacker-supplied content, yielding full compromise of confidentiality, integrity, and availability. The vulnerability spans multiple .NET Long-Term Support and current release trains (8.0, 9.0, 10.0, 11.0), significantly broadening the attack surface beyond the IDE to include build servers and CI/CD pipelines ingesting .NET artifacts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | User interaction is required: a victim must open or process attacker-controlled content - such as a project file, solution, build artifact, or NuGet package - using an unpatched version of Visual Studio 2022 (17.14.x before 17.14.40), Visual Studio 2026 (18.9.x before 18.9.3), or an affected .NET runtime or SDK (8.0.x before 8.0.31, 9.0.x before 9.0.20, 10.0.x before 10.0.12, or 11.0 pre-RC1). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects high severity but not fully automatable exploitation: no credentials are required and the network attack vector enables broad delivery, yet a victim must actively interact with the malicious content. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply vendor-released patches immediately: update Visual Studio 2026 to 18.9.3, Visual Studio 2022 to 17.14.40, .NET 8.0 to 8.0.31, .NET 9.0 to 9.0.20, .NET 10.0 to 10.0.12, and .NET 11.0 to RC1 or later as it becomes generally available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a comprehensive audit of all Visual Studio 2022 and 2026 installations and build server infrastructure to identify affected systems, prioritizing CI/CD environments and artifact processing systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Visual Studio 2022
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
HTTP request smuggling in System.Net.HttpListener across .NET 8.0, 9.0, and 10.0 enables unauthenticated remote attacker
.NET and Visual Studio Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is re
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today