Microsoft Visual Studio 2026 Version 18.10 vulnerabilities

CVE-2026-105016 [CRITICAL] CWE-122 CVE-2026-105016: Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

CVE-2026-88092 [CRITICAL] CWE-444 CVE-2026-88092: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core all Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

CVE-2026-70188 [CRITICAL] CWE-444 CVE-2026-70188: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core all Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-83520 [HIGH] CWE-502 CVE-2026-83520: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a net Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

CVE-2026-70035 [HIGH] CWE-502 CVE-2026-70035: Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.

CVE-2026-87697 [HIGH] CWE-502 CVE-2026-87697: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a net Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

CVE-2026-70174 [HIGH] CWE-358 CVE-2026-70174: Improperly implemented security check for standard in .NET allows an unauthorized attacker to execut Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.

CVE-2026-96235 [HIGH] CWE-787 CVE-2026-96235: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

CVE-2026-70007 [HIGH] CWE-787 CVE-2026-70007: Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.

CVE-2026-96224 [HIGH] CWE-787 CVE-2026-96224: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

CVE-2026-70175 [HIGH] CWE-640 CVE-2026-70175: Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-103572 [HIGH] CWE-94 CVE-2026-103572: Improper control of generation of code ('code injection') in Visual Studio Tools for Applications an Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.

CVE-2026-102870 [HIGH] CWE-94 CVE-2026-102870: Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized att Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

CVE-2026-102869 [HIGH] CWE-843 CVE-2026-102869: Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an un Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-70197 [HIGH] CWE-787 CVE-2026-70197: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

CVE-2026-70179 [HIGH] CWE-290 CVE-2026-70179: Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privilege Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVE-2026-85363 [HIGH] CWE-190 CVE-2026-85363: Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileg Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-96957 [HIGH] CWE-347 CVE-2026-96957: Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-70183 [HIGH] CWE-362 CVE-2026-70183: Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.N Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVE-2026-96237 [HIGH] CWE-829 CVE-2026-96237: Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.