Microsoft Visual Studio 2026 vulnerabilities

CVE-2026-47303 [HIGH] CWE-90 CVE-2026-47303: Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to ele Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVE-2026-47300 [HIGH] CWE-303 CVE-2026-47300: Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker t Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVE-2026-88092 [CRITICAL] CWE-444 CVE-2026-88092: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core all Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

CVE-2026-47304 [CRITICAL] CWE-345 CVE-2026-47304: Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-69439 [HIGH] CWE-122 CVE-2026-69439: Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate priv Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-71328 [HIGH] CWE-122 CVE-2026-71328: Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a n Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

CVE-2026-77907 [HIGH] CWE-122 CVE-2026-77907: Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a n Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

CVE-2026-77906 [HIGH] CWE-122 CVE-2026-77906: Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a n Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

CVE-2026-96957 [HIGH] CWE-347 CVE-2026-96957: Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-69805 [HIGH] CWE-73 CVE-2026-69805: External control of file name or path in .NET allows an unauthorized attacker to elevate privileges External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-50528 [HIGH] CWE-302 CVE-2026-50528: Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-32203 [HIGH] CWE-20 CVE-2026-32203: Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny servic Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.

CVE-2026-50649 [HIGH] CWE-502 CVE-2026-50649: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally. Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

CVE-2026-45591 [HIGH] CWE-400 CVE-2026-45591: Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service ov Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVE-2026-50646 [HIGH] CWE-502 CVE-2026-50646: Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code local Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

CVE-2026-62898 [HIGH] CWE-416 CVE-2026-62898: Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a netw Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

CVE-2026-62901 [HIGH] CWE-606 CVE-2026-62901: Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a ne Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.

CVE-2026-50524 [HIGH] CWE-1287 CVE-2026-50524: Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.

CVE-2026-70354 [HIGH] CWE-787 CVE-2026-70354: Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

CVE-2026-50527 [HIGH] CWE-121 CVE-2026-50527: Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.