Microsoft Visual Studio 2022 vulnerabilities
128 known vulnerabilities affecting microsoft/visual_studio_2022.
Total CVEs
128
CISA KEV
2
actively exploited
Public exploits
2
Exploited in wild
2
Severity breakdown
CRITICAL7HIGH94MEDIUM27
Vulnerabilities
Page 3 of 7
CVE-2026-50524P3HIGHCVSS 7.5≥ 17.12.0, < 17.12.22≥ 17.14.0, < 17.14.362026-07-14
CVE-2026-50524 [HIGH] CWE-1287 CVE-2026-50524: Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-70354P3HIGHCVSS 7.8≥ 17.14.0, < 17.14.382026-08-11
CVE-2026-70354 [HIGH] CWE-787 CVE-2026-70354: Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-50527P3HIGHCVSS 7.5≥ 17.12.0, < 17.12.22≥ 17.14.0, < 17.14.362026-07-14
CVE-2026-50527 [HIGH] CWE-121 CVE-2026-50527: Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a
Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-96222P3HIGHCVSS 7.4≥ 17.14.0, < 17.14.422026-10-13
CVE-2026-96222 [HIGH] CWE-295 CVE-2026-96222: Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthoriz
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2023-33127P3HIGHCVSS 8.1≥ 17.0, < 17.0.23≥ 17.2.0, < 17.2.17+3 more2023-07-11
CVE-2023-33127 [HIGH] CWE-1220 CVE-2023-33127: .NET and Visual Studio Elevation of Privilege Vulnerability
.NET and Visual Studio Elevation of Privilege Vulnerability
nvd
CVE-2025-21172P3HIGHCVSS 7.5≥ 17.6.0, < 17.6.22≥ 17.8.0, < 17.8.17+2 more2025-01-14
CVE-2025-21172 [HIGH] CWE-122 CVE-2025-21172: .NET and Visual Studio Remote Code Execution Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
nvd
CVE-2026-62871P3HIGHCVSS 7.8≥ 17.14.0, < 17.14.382026-08-11
CVE-2026-62871 [HIGH] CWE-122 CVE-2026-62871: Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-47302P3HIGHCVSS 7.5≥ 17.12.0, < 17.12.22≥ 17.14.0, < 17.14.362026-07-14
CVE-2026-47302 [HIGH] CWE-770 CVE-2026-47302: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-50648P3HIGHCVSS 7.5≥ 17.12.0, < 17.12.22≥ 17.14.0, < 17.14.362026-07-14
CVE-2026-50648 [HIGH] CWE-770 CVE-2026-50648: Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attack
Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-50525P3HIGHCVSS 7.5≥ 17.12.0, < 17.12.22≥ 17.14.0, < 17.14.362026-07-14
CVE-2026-50525 [HIGH] CWE-770 CVE-2026-50525: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-50651P3HIGHCVSS 7.5≥ 17.12.0, < 17.12.22≥ 17.14.0, < 17.14.362026-07-14
CVE-2026-50651 [HIGH] CWE-770 CVE-2026-50651: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-32177P3HIGHCVSS 7.3≥ 17.12.0, < 17.12.20≥ 17.14.0, < 17.14.322026-05-12
CVE-2026-32177 [HIGH] CWE-20 CVE-2026-32177: Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
nvd
CVE-2024-20656P3HIGHCVSS 7.8≥ 17.2, < 17.2.23≥ 17.4, < 17.4.15+1 more2024-01-09
CVE-2024-20656 [HIGH] CWE-59 CVE-2024-20656: Visual Studio Elevation of Privilege Vulnerability
Visual Studio Elevation of Privilege Vulnerability
nvd
CVE-2025-26646P3HIGHCVSS 8.0≥ 17.8.0, < 17.8.21≥ 17.10.0, < 17.10.15+2 more2025-05-13
CVE-2025-26646 [HIGH] CWE-73 CVE-2025-26646: External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allo
External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2025-26682P3HIGHCVSS 7.5≥ 17.8.0, < 17.8.20≥ 17.10.0, < 17.10.13+2 more2025-04-08
CVE-2025-26682 [HIGH] CWE-770 CVE-2025-26682: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-62886P3HIGHCVSS 7.8≥ 17.14.0, < 17.14.382026-08-11
CVE-2026-62886 [HIGH] CWE-122 CVE-2026-62886: Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
nvd
CVE-2026-62909P3HIGHCVSS 7.8≥ 17.14.0, < 17.14.382026-08-11
CVE-2026-62909 [HIGH] CWE-252 CVE-2026-62909: Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.
Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-32702P3HIGHCVSS 7.8≥ 17.8.0, < 17.8.21≥ 17.10.0, < 17.10.14+2 more2025-05-13
CVE-2025-32702 [HIGH] CWE-77 CVE-2025-32702: Improper neutralization of special elements used in a command ('command injection') in Visual Studio
Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-47305P3HIGHCVSS 7.8≥ 17.12.0, < 17.12.22≥ 17.14.0, < 17.14.362026-07-14
CVE-2026-47305 [HIGH] CWE-693 CVE-2026-47305: Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locall
Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.
nvd
CVE-2025-30399P3HIGHCVSS 7.5≥ 17.8.0, < 17.8.22≥ 17.10.0, < 17.10.16+2 more2025-06-13
CVE-2025-30399 [HIGH] CWE-426 CVE-2025-30399: Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over
Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.
nvd