OnlyPatch
Visual Studio

CVE-2026-71328 — .NET and Visual Studio Remote Code Execution Vulnerability

Important CVSS 8.8 2026-09 archive

Executive Summary

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

Overview

8.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Exploitation Unlikely
MS Exploit Likelihood
Category Remote Code Execution
Weakness CWE-122: Heap-based Buffer Overflow
Released Sep 8 2026
Last Updated Sep 8 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known

CVSS Vector

ATTACK VECTOR
Network
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
None
USER INTERACTION
Required
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 7.7

EPSS Score

No EPSS score available for this CVE.

View on FIRST.org

Affected Products

6 affected products
Product KB Article Severity Impact Restart Required
.NET 10.0 installed on Windows 5126106 (Security Update) Important Remote Code Execution Yes
.NET 11.0 installed on Windows (Security Update) Important Remote Code Execution Yes
.NET 8.0 installed on Windows 5126104 (Security Update) Important Remote Code Execution Yes
.NET 9.0 installed on Windows 5126105 (Security Update) Important Remote Code Execution Yes
Microsoft Visual Studio 2022 version 17.14 Release Notes (Security Update) Important Remote Code Execution Yes
Microsoft Visual Studio 2026 version 18.9 Release Notes (Security Update) Important Remote Code Execution Yes

Patches

5 patches
Article Type Restart
5126106 Security Update Yes
Security Update Yes
5126104 Security Update Yes
5126105 Security Update Yes
Release Notes Security Update Yes

Exploits & PoC

Detection Rules

Acknowledgments

41ae55e9310ff27fa6f26af4727e5590

On This Page