DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-69522: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2026-69522)

#security #cve #cybersecurity

.NET and Visual Studio Remote Code Execution Vulnerability (CVE-2026-69522)

Vulnerability ID: CVE-2026-69522
CVSS Score: 8.8
Published: 2026-09-09

CVE-2026-69522 is a high-severity Remote Code Execution (RCE) vulnerability in Microsoft .NET runtimes, .NET Framework, and Visual Studio caused by a heap-based buffer overflow (CWE-122). An unauthenticated attacker can exploit this flaw by inducing a user to open a malicious project file or by transmitting crafted payloads over the network, leading to arbitrary code execution within the context of the running application.

TL;DR

A heap-based buffer overflow in .NET and Visual Studio allows unauthenticated remote code execution via malformed project files or network payloads.

Technical Details

  • CWE ID: CWE-122
  • Attack Vector: Network (AV:N)
  • CVSS Score: 8.8
  • EPSS Score: 0.00805 (Percentile: 54.60%)
  • Exploit Status: No public PoC available
  • KEV Status: Not listed
  • Impact: Remote Code Execution

Affected Systems

  • Microsoft .NET Runtime 8.0
  • Microsoft .NET Runtime 9.0
  • Microsoft .NET Runtime 10.0
  • Microsoft .NET Framework 3.5
  • Microsoft .NET Framework 4.6.2
  • Microsoft .NET Framework 4.7
  • Microsoft .NET Framework 4.8
  • Microsoft .NET Framework 4.8.1
  • Microsoft Visual Studio 2022
  • Microsoft Visual Studio 2026
  • .NET: >= 8.0.0, < 8.0.31 (Fixed in: 8.0.31)
  • .NET: >= 9.0.0, < 9.0.20 (Fixed in: 9.0.20)
  • .NET: >= 10.0.0, < 10.0.12 (Fixed in: 10.0.12)
  • Visual Studio 2022: >= 17.14.0, < 17.14.40 (Fixed in: 17.14.40)
  • Visual Studio 2026: >= 18.9.0, < 18.9.3 (Fixed in: 18.9.3)

Mitigation Strategies

  • Apply cumulative quality updates and IDE security patches provided by Microsoft.
  • Restrict execution of automatic build or design-time compilation when opening untrusted workspaces.
  • Monitor network egress logs for anomalies in developer network segments.

Remediation Steps:

  1. Update all local .NET SDKs and runtimes to versions 8.0.31, 9.0.20, 10.0.12, or 11.0 RC1.
  2. Update Visual Studio 2022 to 17.14.40 and Visual Studio 2026 to 18.9.3.
  3. Apply the September 2026 Windows Cumulative Quality Update for .NET Framework environments.
  4. Enforce Visual Studio Trust Settings to require approval before opening folders from unverified zones.

References

Read the full report for CVE-2026-69522 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)