Microsoft Visual Studio 2026 vulnerabilities
40 known vulnerabilities affecting microsoft/visual_studio_2026.
Total CVEs
40
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL2HIGH30MEDIUM8
Vulnerabilities
Page 2 of 2
CVE-2026-96222P3HIGHCVSS 7.4≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-96222 [HIGH] CWE-295 CVE-2026-96222: Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthoriz
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-62871P3HIGHCVSS 7.8≥ 18.8.0, < 18.8.32026-08-11
CVE-2026-62871 [HIGH] CWE-122 CVE-2026-62871: Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-47302P3HIGHCVSS 7.5≥ 18.7.0, < 18.7.42026-07-14
CVE-2026-47302 [HIGH] CWE-770 CVE-2026-47302: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-50648P3HIGHCVSS 7.5≥ 18.7.0, < 18.7.42026-07-14
CVE-2026-50648 [HIGH] CWE-770 CVE-2026-50648: Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attack
Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-50525P3HIGHCVSS 7.5≥ 18.7.0, < 18.7.42026-07-14
CVE-2026-50525 [HIGH] CWE-770 CVE-2026-50525: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-50651P3HIGHCVSS 7.5≥ 18.7.0, < 18.7.42026-07-14
CVE-2026-50651 [HIGH] CWE-770 CVE-2026-50651: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-32177P3HIGHCVSS 7.3≥ 18.5.0, < 18.5.32026-05-12
CVE-2026-32177 [HIGH] CWE-20 CVE-2026-32177: Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
nvd
CVE-2026-62886P3HIGHCVSS 7.8≥ 18.8.0, < 18.8.32026-08-11
CVE-2026-62886 [HIGH] CWE-122 CVE-2026-62886: Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
nvd
CVE-2026-62909P3HIGHCVSS 7.8≥ 18.8.0, < 18.8.32026-08-11
CVE-2026-62909 [HIGH] CWE-252 CVE-2026-62909: Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.
Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-47305P3HIGHCVSS 7.8≥ 18.7.0, < 18.7.42026-07-14
CVE-2026-47305 [HIGH] CWE-693 CVE-2026-47305: Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locall
Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-50659P3MEDIUMCVSS 6.5≥ 18.7.0, < 18.7.42026-07-14
CVE-2026-50659 [MEDIUM] CWE-116 CVE-2026-50659: Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing ov
Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-62899P3MEDIUMCVSS 5.9≥ 18.8.0, < 18.8.32026-08-11
CVE-2026-62899 [MEDIUM] CWE-444 CVE-2026-62899: Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an u
Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.
nvd
CVE-2026-85790P3MEDIUMCVSS 5.9≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-85790 [MEDIUM] CWE-416 CVE-2026-85790: Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a netw
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-69806P3HIGHCVSS 7.0≥ 18.9.0, < 18.9.32026-09-08
CVE-2026-69806 [HIGH] CWE-94 CVE-2026-69806: Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to
Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-62902P3MEDIUMCVSS 6.5≥ 18.8.0, < 18.8.32026-08-11
CVE-2026-62902 [MEDIUM] CWE-693 CVE-2026-62902: Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-62897P3HIGHCVSS 7.0≥ 18.8.0, < 18.8.32026-08-11
CVE-2026-62897 [HIGH] CWE-190 CVE-2026-62897: Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code loc
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-58649P3MEDIUMCVSS 6.5≥ 18.9.0, < 18.9.32026-09-08
CVE-2026-58649 [MEDIUM] CWE-346 CVE-2026-58649: Origin validation error in .NET allows an unauthorized attacker to disclose information over a netwo
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-69304P3MEDIUMCVSS 5.9≥ 18.9.0, < 18.9.32026-09-08
CVE-2026-69304 [MEDIUM] CWE-409 CVE-2026-69304: Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthori
Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-62900P3MEDIUMCVSS 5.9≥ 18.8.0, < 18.8.32026-08-11
CVE-2026-62900 [MEDIUM] CWE-212 CVE-2026-62900: Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized
Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-50526P4MEDIUMCVSS 5.5≥ 18.7.0, < 18.7.42026-07-14
CVE-2026-50526 [MEDIUM] CWE-59 CVE-2026-50526: Improper link resolution before file access ('link following') in .NET allows an authorized attacker
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
nvd
← Previous2 / 2