CVE-2026-69522: .NET and Visual Studio Remote Code Execution Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
Other sources
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9183 & 3.0.30729.9169 & 4.8.9347.0Patch KB5126052 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.9.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9183 & 3.0.30729.9169 & 4.8.9347.0Patch KB5126424 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9070 & 3.0.30729.9068 & 4.7.4145.0Patch KB5126043 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0 RC1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9070 & 3.0.30729.9068 & 4.8.4806.0Patch KB5126421 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9183 & 3.0.30729.9169 & 4.8.9346.0Patch KB5126421 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.7.4145.0Patch KB5126045 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9183 & 3.0.30729.9169 & 4.8.9347.0Patch KB5126422 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.9347.0Patch KB5126053 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.7.4145.0Patch KB5126044 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.4806.0Patch KB5126047 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.8984 & 3.0.30729.8980 & 4.7.4145.0Patch KB5126042 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9183 & 3.0.30729.9169 & 4.8.4806.0Patch KB5126046 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9183 & 3.0.30729.9169 & 4.8.4806.0Patch KB5126050 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9070 & 3.0.30729.9068 & 4.8.4806.0Patch KB5126048 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.4806.0Patch KB5126051 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.40 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.4806.0Patch KB5126049 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.31
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or elevated privileges?
No. The vector indicates network exploitation with low attack complexity and no privileges required, although user interaction is required.
What is the potential impact if exploitation succeeds?
Successful exploitation can result in remote code execution. The supplied scoring data indicates high impact to confidentiality, integrity, and availability.
Which listed products should be included in exposure assessment?
Assess Microsoft Visual Studio 2022 and Visual Studio 2026, plus Windows installations of Microsoft .NET Framework and .NET 8.0, 9.0, 10.0, and 11.0.