Visual Studio 2026
Monthly
Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable via a heap-based buffer overflow triggered when a victim opens a specially crafted file. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates unauthenticated network-reachable exploitation requiring only that the target developer open an attacker-supplied artifact - a realistic social-engineering scenario in development environments. Full compromise of confidentiality, integrity, and availability of the victim's system is possible upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable by unauthenticated network-reachable attackers via a heap-based buffer overflow in the IDE, though user interaction is required to trigger the flaw. The CVSS score of 8.8 reflects the high impact potential - full compromise of confidentiality, integrity, and availability - moderated only by the need for a developer to open or process a crafted file. A vendor patch has been released; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when a victim user interacts with attacker-supplied content, yielding full compromise of confidentiality, integrity, and availability. The vulnerability spans multiple .NET Long-Term Support and current release trains (8.0, 9.0, 10.0, 11.0), significantly broadening the attack surface beyond the IDE to include build servers and CI/CD pipelines ingesting .NET artifacts. Reported through Microsoft's MSRC channel (secure@microsoft.com) with a vendor patch now available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Microsoft .NET Runtime and Visual Studio exploits a code injection weakness (CWE-94) allowing a low-privileged authenticated local user to gain full system-level control over confidentiality, integrity, and availability. Affected versions span .NET 9.0, 10.0, and the pre-release 11.0 RC1, plus Visual Studio 2022 (17.14.x) and the pre-release Visual Studio 2026 (18.9.x). No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected release branches.
Privilege elevation in Microsoft Visual Studio 2022 (17.14.0 to <17.14.40), Visual Studio 2026 (18.9.0 to <18.9.3), and the Microsoft.Diagnostics.Runtime (ClrMD) library stems from external control of a file name or path (CWE-73) that a higher-privileged process then resolves without canonicalization, letting an unauthenticated remote attacker influence which file is opened or executed and thereby gain the privileges of the resolving process. The assessed vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, CVSS 8.1) confirms no authentication or user interaction is required, but the high attack-complexity rating reflects that success depends on specific input conditions and on whether the affected developer/diagnostics component actually consumes attacker-influenced paths in a given deployment. Risk signals are mixed: EPSS is only 0.51% (42nd percentile), CISA SSVC records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis, so this is a high-severity but not high-urgency issue; vendor patches are available and the affected components are developer tooling rather than always-on network services.
Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker to achieve privilege escalation - and given the full C:H/I:H/A:H CVSS impact, effectively arbitrary code execution - on affected systems when a user interacts with attacker-controlled content. Affected are .NET 8.0 through 11.0 RC1 and Visual Studio 2022/2026 across multiple release trains. The Microsoft Security Response Center disclosed and patched the issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full code execution upon successful exploitation, with high impact across confidentiality, integrity, and availability. The vulnerability requires user interaction - such as opening a malicious file or running a crafted application - making social engineering a likely delivery vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Microsoft Security Response Center has acknowledged the issue.
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows a low-privileged local attacker to elevate privileges by triggering an uncaught exception (CWE-248) within the runtime. The CVSS scope change (S:C) indicates impact extends beyond the .NET security boundary to the underlying host system. No public exploit identified at time of analysis, and Microsoft has released patched versions across all affected branches.
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang .NET applications by supplying crafted input that exploits an unchecked loop termination condition. Affected are .NET 8.0 (all releases through 8.0.29), .NET 9.0 (through 9.0.18), .NET 10.0 (through 10.0.10), and bundled Visual Studio 2022 and 2026 installations. No public exploit has been identified at time of analysis, but the low attack complexity and lack of authentication requirement make this a credible automated threat against any internet-exposed .NET service. Vendor-released patches are available and should be applied promptly, particularly for externally reachable endpoints. Note: the ENISA EUVD tags this as 'Authentication Bypass,' which conflicts with the description and CVSS impact metrics (C:N/I:N/A:H); this discrepancy should be verified with Microsoft's advisory.
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to unauthenticated remote attackers over the network, resulting in high-severity information disclosure. Affected software spans .NET 8.0, 9.0, and 10.0 runtimes and Microsoft Visual Studio 2022 and 2026, all of which embed MsQuic as their QUIC and HTTP/3 transport layer. No CISA KEV listing or public exploit code has been identified at time of analysis, but the network-reachable, zero-authentication attack vector gives this a realistic exposure profile for any .NET service accepting QUIC connections from untrusted networks.
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process compromise (C:H/I:H/A:H) across a broad product surface spanning .NET Framework 3.5 through 4.8.1, .NET 8.0, 9.0, 10.0, and Visual Studio 2022 and 2026. An attacker who can deliver crafted input processed by a vulnerable .NET application can trigger arithmetic wraparound (CWE-190) to corrupt runtime memory and execute arbitrary code within the process context. Microsoft has released patches across all affected product lines; no public exploit identified at time of analysis, and no CISA KEV listing is present.
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results from a heap-based buffer overflow triggered by an integer overflow or wraparound condition in the runtime's memory handling. An unprivileged local user who interacts with a crafted input - such as a malicious file processed by a .NET application - can exploit the flaw to gain elevated privileges on the host system. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available from Microsoft.
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET release streams (8.0, 9.0, 10.0) and associated Visual Studio tooling. The flaw requires user interaction - consistent with a file-processing or input-parsing trigger - but no elevated privileges, meaning an attacker can exploit it by inducing a user to open or process a maliciously crafted artifact within a vulnerable .NET context. Full confidentiality, integrity, and availability compromise of the affected process is possible on successful exploitation. No public exploit identified at time of analysis and no CISA KEV listing; Microsoft has released patches across all affected branches.
Remote denial of service in ASP.NET Core enables unauthenticated network attackers to exhaust server resources and disrupt application availability. The CVSS 7.5 score reflects high availability impact with low attack complexity and no required privileges or user interaction, though no public exploit identified at time of analysis. Microsoft (secure@microsoft.com) is the reporting source via MSRC, indicating a vendor-coordinated disclosure.
Decompression bomb (CWE-409) in ASP.NET Core allows unauthenticated remote attackers to exhaust server resources and deny service by submitting highly compressed HTTP payloads that expand disproportionately during server-side processing. Affected releases span .NET 8.0, 9.0, and 10.0 runtimes, all corresponding ASP.NET Core versions, and Visual Studio 2022/2026 which embed affected runtimes. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected version lines.
Origin validation error (CWE-346) in Microsoft .NET enables network-based information disclosure where an unauthenticated remote attacker can read sensitive data from a .NET application by exploiting improper validation of request origins. Affected are multiple active .NET release trains (8.0, 9.0, 10.0, 11.0 RC1) and Microsoft Visual Studio 2022 and 2026 where bundled .NET runtimes are included. The CVSS vector (UI:R) indicates user interaction is required, consistent with a cross-origin attack pattern where a victim must visit an attacker-controlled page that triggers the malicious cross-origin request. No public exploit code or CISA KEV listing has been identified at time of analysis.
Information disclosure in Windows Presentation Foundation (WPF) within .NET 8, 9, and 10 allows an unauthenticated network attacker to exfiltrate sensitive data when a target user opens a specially crafted document. The WPF document parser resolves external references from attacker-controlled URIs - an SSRF-adjacent primitive (CWE-829, CWE-918) - causing outbound network requests that can expose authentication tokens or internal metadata to the attacker's infrastructure. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available for all affected .NET and Visual Studio versions.
Information disclosure in Microsoft .NET (versions 8.0.0-8.0.29, 9.0.0-9.0.18, and 10.0.0-10.0.10) and Visual Studio 2022/2026 exposes sensitive data over the network due to improper sanitization of information prior to network transfer, classified under CWE-212. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates unauthenticated network exploitation gated by high attack complexity, yielding full confidentiality compromise (C:H) with no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC confirms no known exploitation, and Microsoft has released patches across all affected product lines.
HTTP request smuggling in System.Net.HttpListener across .NET 8.0, 9.0, and 10.0 enables unauthenticated remote attackers to bypass security features on Linux and macOS deployments. The flaw stems from inconsistent HTTP request interpretation (CWE-444), allowing crafted requests to circumvent authentication or access controls with high confidentiality impact. Exploitation carries high attack complexity (AC:H), no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing this in a monitored-but-not-emergency posture for most organizations.
Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable via a heap-based buffer overflow triggered when a victim opens a specially crafted file. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates unauthenticated network-reachable exploitation requiring only that the target developer open an attacker-supplied artifact - a realistic social-engineering scenario in development environments. Full compromise of confidentiality, integrity, and availability of the victim's system is possible upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable by unauthenticated network-reachable attackers via a heap-based buffer overflow in the IDE, though user interaction is required to trigger the flaw. The CVSS score of 8.8 reflects the high impact potential - full compromise of confidentiality, integrity, and availability - moderated only by the need for a developer to open or process a crafted file. A vendor patch has been released; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when a victim user interacts with attacker-supplied content, yielding full compromise of confidentiality, integrity, and availability. The vulnerability spans multiple .NET Long-Term Support and current release trains (8.0, 9.0, 10.0, 11.0), significantly broadening the attack surface beyond the IDE to include build servers and CI/CD pipelines ingesting .NET artifacts. Reported through Microsoft's MSRC channel (secure@microsoft.com) with a vendor patch now available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Microsoft .NET Runtime and Visual Studio exploits a code injection weakness (CWE-94) allowing a low-privileged authenticated local user to gain full system-level control over confidentiality, integrity, and availability. Affected versions span .NET 9.0, 10.0, and the pre-release 11.0 RC1, plus Visual Studio 2022 (17.14.x) and the pre-release Visual Studio 2026 (18.9.x). No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected release branches.
Privilege elevation in Microsoft Visual Studio 2022 (17.14.0 to <17.14.40), Visual Studio 2026 (18.9.0 to <18.9.3), and the Microsoft.Diagnostics.Runtime (ClrMD) library stems from external control of a file name or path (CWE-73) that a higher-privileged process then resolves without canonicalization, letting an unauthenticated remote attacker influence which file is opened or executed and thereby gain the privileges of the resolving process. The assessed vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, CVSS 8.1) confirms no authentication or user interaction is required, but the high attack-complexity rating reflects that success depends on specific input conditions and on whether the affected developer/diagnostics component actually consumes attacker-influenced paths in a given deployment. Risk signals are mixed: EPSS is only 0.51% (42nd percentile), CISA SSVC records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis, so this is a high-severity but not high-urgency issue; vendor patches are available and the affected components are developer tooling rather than always-on network services.
Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker to achieve privilege escalation - and given the full C:H/I:H/A:H CVSS impact, effectively arbitrary code execution - on affected systems when a user interacts with attacker-controlled content. Affected are .NET 8.0 through 11.0 RC1 and Visual Studio 2022/2026 across multiple release trains. The Microsoft Security Response Center disclosed and patched the issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full code execution upon successful exploitation, with high impact across confidentiality, integrity, and availability. The vulnerability requires user interaction - such as opening a malicious file or running a crafted application - making social engineering a likely delivery vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Microsoft Security Response Center has acknowledged the issue.
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows a low-privileged local attacker to elevate privileges by triggering an uncaught exception (CWE-248) within the runtime. The CVSS scope change (S:C) indicates impact extends beyond the .NET security boundary to the underlying host system. No public exploit identified at time of analysis, and Microsoft has released patched versions across all affected branches.
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang .NET applications by supplying crafted input that exploits an unchecked loop termination condition. Affected are .NET 8.0 (all releases through 8.0.29), .NET 9.0 (through 9.0.18), .NET 10.0 (through 10.0.10), and bundled Visual Studio 2022 and 2026 installations. No public exploit has been identified at time of analysis, but the low attack complexity and lack of authentication requirement make this a credible automated threat against any internet-exposed .NET service. Vendor-released patches are available and should be applied promptly, particularly for externally reachable endpoints. Note: the ENISA EUVD tags this as 'Authentication Bypass,' which conflicts with the description and CVSS impact metrics (C:N/I:N/A:H); this discrepancy should be verified with Microsoft's advisory.
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to unauthenticated remote attackers over the network, resulting in high-severity information disclosure. Affected software spans .NET 8.0, 9.0, and 10.0 runtimes and Microsoft Visual Studio 2022 and 2026, all of which embed MsQuic as their QUIC and HTTP/3 transport layer. No CISA KEV listing or public exploit code has been identified at time of analysis, but the network-reachable, zero-authentication attack vector gives this a realistic exposure profile for any .NET service accepting QUIC connections from untrusted networks.
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process compromise (C:H/I:H/A:H) across a broad product surface spanning .NET Framework 3.5 through 4.8.1, .NET 8.0, 9.0, 10.0, and Visual Studio 2022 and 2026. An attacker who can deliver crafted input processed by a vulnerable .NET application can trigger arithmetic wraparound (CWE-190) to corrupt runtime memory and execute arbitrary code within the process context. Microsoft has released patches across all affected product lines; no public exploit identified at time of analysis, and no CISA KEV listing is present.
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results from a heap-based buffer overflow triggered by an integer overflow or wraparound condition in the runtime's memory handling. An unprivileged local user who interacts with a crafted input - such as a malicious file processed by a .NET application - can exploit the flaw to gain elevated privileges on the host system. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available from Microsoft.
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET release streams (8.0, 9.0, 10.0) and associated Visual Studio tooling. The flaw requires user interaction - consistent with a file-processing or input-parsing trigger - but no elevated privileges, meaning an attacker can exploit it by inducing a user to open or process a maliciously crafted artifact within a vulnerable .NET context. Full confidentiality, integrity, and availability compromise of the affected process is possible on successful exploitation. No public exploit identified at time of analysis and no CISA KEV listing; Microsoft has released patches across all affected branches.
Remote denial of service in ASP.NET Core enables unauthenticated network attackers to exhaust server resources and disrupt application availability. The CVSS 7.5 score reflects high availability impact with low attack complexity and no required privileges or user interaction, though no public exploit identified at time of analysis. Microsoft (secure@microsoft.com) is the reporting source via MSRC, indicating a vendor-coordinated disclosure.
Decompression bomb (CWE-409) in ASP.NET Core allows unauthenticated remote attackers to exhaust server resources and deny service by submitting highly compressed HTTP payloads that expand disproportionately during server-side processing. Affected releases span .NET 8.0, 9.0, and 10.0 runtimes, all corresponding ASP.NET Core versions, and Visual Studio 2022/2026 which embed affected runtimes. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected version lines.
Origin validation error (CWE-346) in Microsoft .NET enables network-based information disclosure where an unauthenticated remote attacker can read sensitive data from a .NET application by exploiting improper validation of request origins. Affected are multiple active .NET release trains (8.0, 9.0, 10.0, 11.0 RC1) and Microsoft Visual Studio 2022 and 2026 where bundled .NET runtimes are included. The CVSS vector (UI:R) indicates user interaction is required, consistent with a cross-origin attack pattern where a victim must visit an attacker-controlled page that triggers the malicious cross-origin request. No public exploit code or CISA KEV listing has been identified at time of analysis.
Information disclosure in Windows Presentation Foundation (WPF) within .NET 8, 9, and 10 allows an unauthenticated network attacker to exfiltrate sensitive data when a target user opens a specially crafted document. The WPF document parser resolves external references from attacker-controlled URIs - an SSRF-adjacent primitive (CWE-829, CWE-918) - causing outbound network requests that can expose authentication tokens or internal metadata to the attacker's infrastructure. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available for all affected .NET and Visual Studio versions.
Information disclosure in Microsoft .NET (versions 8.0.0-8.0.29, 9.0.0-9.0.18, and 10.0.0-10.0.10) and Visual Studio 2022/2026 exposes sensitive data over the network due to improper sanitization of information prior to network transfer, classified under CWE-212. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates unauthenticated network exploitation gated by high attack complexity, yielding full confidentiality compromise (C:H) with no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC confirms no known exploitation, and Microsoft has released patches across all affected product lines.
HTTP request smuggling in System.Net.HttpListener across .NET 8.0, 9.0, and 10.0 enables unauthenticated remote attackers to bypass security features on Linux and macOS deployments. The flaw stems from inconsistent HTTP request interpretation (CWE-444), allowing crafted requests to circumvent authentication or access controls with high confidentiality impact. Exploitation carries high attack complexity (AC:H), no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing this in a monitored-but-not-emergency posture for most organizations.