CVE-2026-114151: Visual Studio Remote Code Execution Vulnerability
Published Nov 10, 2026
·Updated
Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.
Other sources
Visual Studio Remote Code Execution Vulnerability
— Microsoft
Affected Software
9 affected componentsFixes available
All of the following
Microsoft .NET>=9.0<9.0.23
9.0.23
Microsoft Windows*
All of the following
Microsoft .NET>=10.0<10.0.15
10.0.15
Microsoft Windows*
All of the following
Microsoft .NET>=11.0<11.0.0
11.0.0
Microsoft Windows*
Microsoft Visual Studio 2026>=18.12<18.12.0
18.12.0
All of the following
Microsoft .NET>=8.0<8.0.34
8.0.34
Microsoft Windows*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.23Patch KB5135242 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.15Patch KB5135241 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.12.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.34Patch KB5135243
Event History
Nov 10, 2026
CVE Published
via Microsoft·04:00 PM
Data Sourced
via Microsoft·04:00 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·04:00 PM
Affected Software
CVE Published
via MITRE·06:19 PM
Data Sourced
via MITRE·06:19 PM
DescriptionSeverity
Data Sourced
via NVD·07:19 PM
DescriptionSeverityWeakness