Visual Studio 2026
Monthly
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full code execution upon successful exploitation, with high impact across confidentiality, integrity, and availability. The vulnerability requires user interaction - such as opening a malicious file or running a crafted application - making social engineering a likely delivery vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Microsoft Security Response Center has acknowledged the issue.
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows a low-privileged local attacker to elevate privileges by triggering an uncaught exception (CWE-248) within the runtime. The CVSS scope change (S:C) indicates impact extends beyond the .NET security boundary to the underlying host system. No public exploit identified at time of analysis, and Microsoft has released patched versions across all affected branches.
Information disclosure in Windows Presentation Foundation (WPF) within .NET 8, 9, and 10 allows an unauthenticated network attacker to exfiltrate sensitive data when a target user opens a specially crafted document. The WPF document parser resolves external references from attacker-controlled URIs - an SSRF-adjacent primitive (CWE-829, CWE-918) - causing outbound network requests that can expose authentication tokens or internal metadata to the attacker's infrastructure. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available for all affected .NET and Visual Studio versions.
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang .NET applications by supplying crafted input that exploits an unchecked loop termination condition. Affected are .NET 8.0 (all releases through 8.0.29), .NET 9.0 (through 9.0.18), .NET 10.0 (through 10.0.10), and bundled Visual Studio 2022 and 2026 installations. No public exploit has been identified at time of analysis, but the low attack complexity and lack of authentication requirement make this a credible automated threat against any internet-exposed .NET service. Vendor-released patches are available and should be applied promptly, particularly for externally reachable endpoints. Note: the ENISA EUVD tags this as 'Authentication Bypass,' which conflicts with the description and CVSS impact metrics (C:N/I:N/A:H); this discrepancy should be verified with Microsoft's advisory.
Information disclosure in Microsoft .NET (versions 8.0.0-8.0.29, 9.0.0-9.0.18, and 10.0.0-10.0.10) and Visual Studio 2022/2026 exposes sensitive data over the network due to improper sanitization of information prior to network transfer, classified under CWE-212. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates unauthenticated network exploitation gated by high attack complexity, yielding full confidentiality compromise (C:H) with no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC confirms no known exploitation, and Microsoft has released patches across all affected product lines.
HTTP request smuggling in System.Net.HttpListener across .NET 8.0, 9.0, and 10.0 enables unauthenticated remote attackers to bypass security features on Linux and macOS deployments. The flaw stems from inconsistent HTTP request interpretation (CWE-444), allowing crafted requests to circumvent authentication or access controls with high confidentiality impact. Exploitation carries high attack complexity (AC:H), no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing this in a monitored-but-not-emergency posture for most organizations.
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to unauthenticated remote attackers over the network, resulting in high-severity information disclosure. Affected software spans .NET 8.0, 9.0, and 10.0 runtimes and Microsoft Visual Studio 2022 and 2026, all of which embed MsQuic as their QUIC and HTTP/3 transport layer. No CISA KEV listing or public exploit code has been identified at time of analysis, but the network-reachable, zero-authentication attack vector gives this a realistic exposure profile for any .NET service accepting QUIC connections from untrusted networks.
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process compromise (C:H/I:H/A:H) across a broad product surface spanning .NET Framework 3.5 through 4.8.1, .NET 8.0, 9.0, 10.0, and Visual Studio 2022 and 2026. An attacker who can deliver crafted input processed by a vulnerable .NET application can trigger arithmetic wraparound (CWE-190) to corrupt runtime memory and execute arbitrary code within the process context. Microsoft has released patches across all affected product lines; no public exploit identified at time of analysis, and no CISA KEV listing is present.
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results from a heap-based buffer overflow triggered by an integer overflow or wraparound condition in the runtime's memory handling. An unprivileged local user who interacts with a crafted input - such as a malicious file processed by a .NET application - can exploit the flaw to gain elevated privileges on the host system. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available from Microsoft.
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET release streams (8.0, 9.0, 10.0) and associated Visual Studio tooling. The flaw requires user interaction - consistent with a file-processing or input-parsing trigger - but no elevated privileges, meaning an attacker can exploit it by inducing a user to open or process a maliciously crafted artifact within a vulnerable .NET context. Full confidentiality, integrity, and availability compromise of the affected process is possible on successful exploitation. No public exploit identified at time of analysis and no CISA KEV listing; Microsoft has released patches across all affected branches.
Remote denial of service in ASP.NET Core enables unauthenticated network attackers to exhaust server resources and disrupt application availability. The CVSS 7.5 score reflects high availability impact with low attack complexity and no required privileges or user interaction, though no public exploit identified at time of analysis. Microsoft (secure@microsoft.com) is the reporting source via MSRC, indicating a vendor-coordinated disclosure.
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full code execution upon successful exploitation, with high impact across confidentiality, integrity, and availability. The vulnerability requires user interaction - such as opening a malicious file or running a crafted application - making social engineering a likely delivery vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Microsoft Security Response Center has acknowledged the issue.
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows a low-privileged local attacker to elevate privileges by triggering an uncaught exception (CWE-248) within the runtime. The CVSS scope change (S:C) indicates impact extends beyond the .NET security boundary to the underlying host system. No public exploit identified at time of analysis, and Microsoft has released patched versions across all affected branches.
Information disclosure in Windows Presentation Foundation (WPF) within .NET 8, 9, and 10 allows an unauthenticated network attacker to exfiltrate sensitive data when a target user opens a specially crafted document. The WPF document parser resolves external references from attacker-controlled URIs - an SSRF-adjacent primitive (CWE-829, CWE-918) - causing outbound network requests that can expose authentication tokens or internal metadata to the attacker's infrastructure. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available for all affected .NET and Visual Studio versions.
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang .NET applications by supplying crafted input that exploits an unchecked loop termination condition. Affected are .NET 8.0 (all releases through 8.0.29), .NET 9.0 (through 9.0.18), .NET 10.0 (through 10.0.10), and bundled Visual Studio 2022 and 2026 installations. No public exploit has been identified at time of analysis, but the low attack complexity and lack of authentication requirement make this a credible automated threat against any internet-exposed .NET service. Vendor-released patches are available and should be applied promptly, particularly for externally reachable endpoints. Note: the ENISA EUVD tags this as 'Authentication Bypass,' which conflicts with the description and CVSS impact metrics (C:N/I:N/A:H); this discrepancy should be verified with Microsoft's advisory.
Information disclosure in Microsoft .NET (versions 8.0.0-8.0.29, 9.0.0-9.0.18, and 10.0.0-10.0.10) and Visual Studio 2022/2026 exposes sensitive data over the network due to improper sanitization of information prior to network transfer, classified under CWE-212. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates unauthenticated network exploitation gated by high attack complexity, yielding full confidentiality compromise (C:H) with no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC confirms no known exploitation, and Microsoft has released patches across all affected product lines.
HTTP request smuggling in System.Net.HttpListener across .NET 8.0, 9.0, and 10.0 enables unauthenticated remote attackers to bypass security features on Linux and macOS deployments. The flaw stems from inconsistent HTTP request interpretation (CWE-444), allowing crafted requests to circumvent authentication or access controls with high confidentiality impact. Exploitation carries high attack complexity (AC:H), no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing this in a monitored-but-not-emergency posture for most organizations.
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to unauthenticated remote attackers over the network, resulting in high-severity information disclosure. Affected software spans .NET 8.0, 9.0, and 10.0 runtimes and Microsoft Visual Studio 2022 and 2026, all of which embed MsQuic as their QUIC and HTTP/3 transport layer. No CISA KEV listing or public exploit code has been identified at time of analysis, but the network-reachable, zero-authentication attack vector gives this a realistic exposure profile for any .NET service accepting QUIC connections from untrusted networks.
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process compromise (C:H/I:H/A:H) across a broad product surface spanning .NET Framework 3.5 through 4.8.1, .NET 8.0, 9.0, 10.0, and Visual Studio 2022 and 2026. An attacker who can deliver crafted input processed by a vulnerable .NET application can trigger arithmetic wraparound (CWE-190) to corrupt runtime memory and execute arbitrary code within the process context. Microsoft has released patches across all affected product lines; no public exploit identified at time of analysis, and no CISA KEV listing is present.
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results from a heap-based buffer overflow triggered by an integer overflow or wraparound condition in the runtime's memory handling. An unprivileged local user who interacts with a crafted input - such as a malicious file processed by a .NET application - can exploit the flaw to gain elevated privileges on the host system. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available from Microsoft.
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET release streams (8.0, 9.0, 10.0) and associated Visual Studio tooling. The flaw requires user interaction - consistent with a file-processing or input-parsing trigger - but no elevated privileges, meaning an attacker can exploit it by inducing a user to open or process a maliciously crafted artifact within a vulnerable .NET context. Full confidentiality, integrity, and availability compromise of the affected process is possible on successful exploitation. No public exploit identified at time of analysis and no CISA KEV listing; Microsoft has released patches across all affected branches.
Remote denial of service in ASP.NET Core enables unauthenticated network attackers to exhaust server resources and disrupt application availability. The CVSS 7.5 score reflects high availability impact with low attack complexity and no required privileges or user interaction, though no public exploit identified at time of analysis. Microsoft (secure@microsoft.com) is the reporting source via MSRC, indicating a vendor-coordinated disclosure.