Visual Studio and .NET: Heap-based buffer overflow allows code execution
Summary
A heap-based buffer overflow in Visual Studio 2026 and in the .NET runtimes 8, 9, 10 and 11 on Windows allows an unauthorized network attacker to execute code. The CVSS vector requires user interaction (UI:R), so an attack most likely needs a user to open untrusted content or use an affected application. The public record does not describe the exact trigger, and CISA SSVC rates the flaw as not automatable.
Affected
- Microsoft .NET 8.0 on Windows: 8.0.0 to before 8.0.34
- Microsoft .NET 9.0 on Windows: 9.0.0 to before 9.0.23
- Microsoft .NET 10.0 on Windows: 10.0.0 to before 10.0.15
- Microsoft .NET 11.0 on Windows: 11.0.0-preview.1 to before 11.0.0
- Microsoft Visual Studio 2026 version 18.11: 18.11.0 to before 18.11.4 (unverified)
- Microsoft Visual Studio 2026 version 18.12: affected range listed in the CVE record, exact fixed build unknown
Fixed in
- .NET 8.0: 8.0.34 (per CVE record)
- .NET 9.0: Unknown.
- .NET 10.0: 10.0.15 (per secondary sources, to be checked against MSRC)
- .NET 11.0: 11.0.0 (per secondary sources, to be checked against MSRC)
- Visual Studio 2026 18.11: 18.11.4 (reported by a third-party aggregator, unverified)
- Visual Studio 2026 18.12: Unknown.
Workaround
Unknown. No workaround was found in the sources reviewed. Updating is the practical mitigation.
Exploitation
- No public proof-of-concept or exploit found.
- Not listed in CISA KEV according to a third-party tracker; live catalog not checked.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Patch Visual Studio 2026 and the affected .NET runtimes on developer workstations and Windows hosts in the next regular cycle.
- Prioritize internet-facing .NET services and servers.
- Until patched, avoid opening untrusted solutions, projects or files in Visual Studio.
- Check the MSRC advisory for the exact fixed versions for each product.
- Inventory installed .NET runtimes and Visual Studio versions.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-114158 www.cve.org
- Microsoft Security Update Guide msrc.microsoft.com
- GitHub PR #611 (.NET 10.0.15 update) github.com
- GitHub PR #229 (.NET SDK 11.0.100 update) github.com
- Strix CVE overview (third-party, unverified) www.strix.ai
- .NET November 2026 servicing updates (mirror) rssfeedtelegrambot.bnaya.co.il
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:42.
Original description (NVD)
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.