CVE-2026-71328: .NET and Visual Studio Remote Code Execution Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
Other sources
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.40 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.9.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0 RC1 - Upgrade
Upgrade
nuget/Microsoft.DiaSymReader.Nativeto a version that resolves this vulnerability.Fixed in 18.9.0-beta1.26405.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.12Patch KB5126106 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.20Patch KB5126105 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.31Patch KB5126104 - Upgrade
Upgrade
Microsoft.DiaSymReader.Nativeto a version that resolves this vulnerability.Fixed in 18.9.0-beta1.26405.2 - Operational
After installing the updated runtime, SDK, Visual Studio, or package, restart your apps so the update takes effect.
Event History
Frequently Asked Questions
Which systems should be prioritized for review?
Prioritize Windows systems with Microsoft Visual Studio 2026 or Visual Studio 2022, and systems with Microsoft .NET 8.0, 9.0, 10.0, or 11.0 installed on Windows.
What level of access does an attacker need to exploit this issue?
The vulnerability is network-reachable and does not require attacker privileges. Exploitation requires user interaction, while the attack complexity is rated low.