Microsoft .NET Framework and Visual Studio: Elevation of privilege via type confusion

Summary

A type confusion flaw (CWE-843) in .NET Framework and Visual Studio allows an attacker to elevate privileges over the network. According to the research notes, the Visual Studio component is Microsoft.DiaSymReader.Native, a debugging-symbol library. The CVSS vector requires no privileges but user interaction, so an attacker would typically need a user to open or run crafted content, for example via phishing or a malicious file. Local privilege escalation is most useful to an attacker who already has a foothold on the system.

Affected

• Microsoft .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 and 4.8.1 (builds before the fixed versions listed in the MSRC advisory; exact build table unverified)
• Microsoft Visual Studio 2022 version 17.14 before 17.14.42
• Microsoft Visual Studio 2026 version 18.10 before 18.10.4

Fixed in

• Visual Studio 2026 18.10.4 and later; Visual Studio 2022 17.14.42 and later
• .NET Framework: October 13, 2026 cumulative and rollup updates (specific KB numbers unverified; check the MSRC advisory)

Workaround

Unknown.

Exploitation

• Not listed as exploited in the sources reviewed.
• Rapid7 rates it Exploitation Less Likely; Tenable reports no known exploits.
• Conflicting data exists (one Tenable Windows plugin marks an exploit as available); treated as unconfirmed.
• EPSS about 0.007.

Our recommendation

• Install the October 13, 2026 Windows and .NET Framework updates on all servers and endpoints through standard monthly patching.
• Update Visual Studio to 18.10.4 or later (or 17.14.42 or later) on developer workstations.
• Verify the exact fixed builds and KB numbers on the MSRC advisory before rollout.
• Monitor for a public proof-of-concept or addition to the CISA KEV catalog, as the status could change.
• Train users to avoid opening untrusted files and links, since user interaction is required.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-102869 msrc.microsoft.com
• Visual Studio 2026 release notes learn.microsoft.com
• Visual Studio 2022 release notes learn.microsoft.com
• Rapid7 October 2026 Patch Tuesday analysis www.rapid7.com
• Tenable plugin 366093 (.NET Framework) www.tenable.com
• NVD mirror on Vulners: CVE-2026-102869 vulners.com
• CVE aggregator: CVE-2026-102869 cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:24.