Microsoft Visual Studio 2022 vulnerabilities
128 known vulnerabilities affecting microsoft/visual_studio_2022.
Total CVEs
128
CISA KEV
2
actively exploited
Public exploits
2
Exploited in wild
2
Severity breakdown
CRITICAL7HIGH94MEDIUM27
Vulnerabilities
Page 2 of 7
CVE-2024-28931P3HIGHCVSS 8.8≥ 17.4.0, < 17.4.18≥ 17.6.0, < 17.6.14+2 more2024-04-09
CVE-2024-28931 [HIGH] CWE-190 CVE-2024-28931: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-28936P3HIGHCVSS 8.8≥ 17.4.0, < 17.4.18≥ 17.6.0, < 17.6.14+2 more2024-04-09
CVE-2024-28936 [HIGH] CWE-190 CVE-2024-28936: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-28929P3HIGHCVSS 8.8≥ 17.4.0, < 17.4.18≥ 17.6.0, < 17.6.14+2 more2024-04-09
CVE-2024-28929 [HIGH] CWE-190 CVE-2024-28929: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-28935P3HIGHCVSS 8.8≥ 17.4.0, < 17.4.18≥ 17.6.0, < 17.6.14+2 more2024-04-09
CVE-2024-28935 [HIGH] CWE-122 CVE-2024-28935: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-28930P3HIGHCVSS 8.8≥ 17.4.0, < 17.4.18≥ 17.6.0, < 17.6.14+2 more2024-04-09
CVE-2024-28930 [HIGH] CWE-191 CVE-2024-28930: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-28937P3HIGHCVSS 8.8≥ 17.4.0, < 17.4.18≥ 17.6.0, < 17.6.14+2 more2024-04-09
CVE-2024-28937 [HIGH] CWE-122 CVE-2024-28937: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-28938P3HIGHCVSS 8.8≥ 17.4.0, < 17.4.18≥ 17.6.0, < 17.6.14+2 more2024-04-09
CVE-2024-28938 [HIGH] CWE-125 CVE-2024-28938: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-0056P3HIGHCVSS 8.7≥ 17.2, < 17.2.23≥ 17.4, < 17.4.15+2 more2024-01-09
CVE-2024-0056 [HIGH] CWE-319 CVE-2024-0056: Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnera
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
nvd
CVE-2024-35264P3HIGHCVSS 8.1≥ 17.4.0, < 17.4.21≥ 17.6.0, < 17.6.17+2 more2024-07-09
CVE-2024-35264 [HIGH] CWE-416 CVE-2024-35264: .NET and Visual Studio Remote Code Execution Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
nvd
CVE-2024-38229P3HIGHCVSS 8.1≥ 17.6.0, < 17.6.20≥ 17.8.0, < 17.8.15+2 more2024-10-08
CVE-2024-38229 [HIGH] CWE-416 CVE-2024-38229: .NET and Visual Studio Remote Code Execution Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
nvd
CVE-2026-50528P3HIGHCVSS 8.2≥ 17.12.0, < 17.12.22≥ 17.14.0, < 17.14.362026-07-14
CVE-2026-50528 [HIGH] CWE-302 CVE-2026-50528: Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a
Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
nvd
CVE-2026-21257P3HIGHCVSS 8.0≥ 17.14.0, < 17.14.262026-02-10
CVE-2026-21257 [HIGH] CWE-77 CVE-2026-21257: Improper neutralization of special elements used in a command ('command injection') in GitHub Copilo
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-32203P3HIGHCVSS 7.5≥ 17.12.0, < 17.12.19≥ 17.14.0, < 17.14.302026-04-14
CVE-2026-32203 [HIGH] CWE-20 CVE-2026-32203: Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny servic
Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
nvd
CVE-2023-36758P3CRITICALCVSS 9.8≥ 17.7, ≤ 17.7.42023-09-12
CVE-2023-36758 [CRITICAL] CWE-59 CVE-2023-36758: Visual Studio Elevation of Privilege Vulnerability
Visual Studio Elevation of Privilege Vulnerability
nvd
CVE-2025-47959P3HIGHCVSS 7.1≥ 17.8.0, < 17.8.22≥ 17.10.0, < 17.10.16+2 more2025-06-13
CVE-2025-47959 [HIGH] CWE-77 CVE-2025-47959: Improper neutralization of special elements used in a command ('command injection') in Visual Studio
Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a network.
nvd
CVE-2026-50646P3HIGHCVSS 7.8≥ 17.12.0, < 17.12.22≥ 17.14.0, < 17.14.362026-07-14
CVE-2026-50646 [HIGH] CWE-502 CVE-2026-50646: Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code local
Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-62898P3HIGHCVSS 7.5≥ 17.14.0, < 17.14.382026-08-11
CVE-2026-62898 [HIGH] CWE-416 CVE-2026-62898: Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a netw
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-53773P3HIGHCVSS 7.8≥ 17.14.0, < 17.14.122025-08-12
CVE-2025-53773 [HIGH] CWE-77 CVE-2025-53773: Improper neutralization of special elements used in a command ('command injection') in GitHub Copilo
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.
nvd
CVE-2023-33170P3HIGHCVSS 8.1≥ 17.0, < 17.0.23≥ 17.2.0, < 17.2.17+2 more2023-07-11
CVE-2023-33170 [HIGH] CWE-362 CVE-2023-33170: ASP.NET and Visual Studio Security Feature Bypass Vulnerability
ASP.NET and Visual Studio Security Feature Bypass Vulnerability
nvd
CVE-2026-62901P3HIGHCVSS 7.5≥ 17.14.0, < 17.14.382026-08-11
CVE-2026-62901 [HIGH] CWE-606 CVE-2026-62901: Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a ne
Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.
nvd