Visual Studio 2022 (Microsoft) - vulnerabilities (CVEs)

209 CVEs, 44 in the last 30 days, 255 known versions, newest CVE from 2026-10-15. Vendor: Microsoft.

CVEs of Visual Studio 2022

CVE-2026-109468 - CVSS 7.5 (high), 2026-10-15: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-105016 - CVSS 9.8 (critical), 2026-10-13: Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
CVE-2026-70162 - CVSS 5.9 (medium), 2026-10-13: A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited…
CVE-2026-102869 - CVSS 8.8 (high), 2026-10-13: Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-58280 - CVSS 7.5 (high), 2026-10-13: Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-102870 - CVSS 8.8 (high), 2026-10-13: Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
CVE-2026-96957 - CVSS 8.8 (high), 2026-10-13: Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96229 - CVSS 6.5 (medium), 2026-10-13: Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-96232 - CVSS 7.5 (high), 2026-10-13: Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-96225 - CVSS 7.8 (high), 2026-10-13: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-96231 - CVSS 7.8 (high), 2026-10-13: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-96235 - CVSS 8.8 (high), 2026-10-13: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-96238 - CVSS 6.5 (medium), 2026-10-13: Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96230 - CVSS 8.8 (high), 2026-10-13: Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a…
CVE-2026-96234 - CVSS 5.3 (medium), 2026-10-13: Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-96237 - CVSS 7.5 (high), 2026-10-13: Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70007 - CVSS 8.8 (high), 2026-10-13: Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
CVE-2026-85363 - CVSS 8.8 (high), 2026-10-13: Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-84008 - CVSS 7.5 (high), 2026-10-13: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-83520 - CVSS 8.8 (high), 2026-10-13: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70035 - CVSS 8.8 (high), 2026-10-13: Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
CVE-2026-88092 - CVSS 9.4 (critical), 2026-10-13: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a…
CVE-2026-96236 - CVSS 7.5 (high), 2026-10-13: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-96224 - CVSS 8.8 (high), 2026-10-13: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-96222 - CVSS 7.4 (high), 2026-10-13: Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-70183 - CVSS 7.5 (high), 2026-10-13: Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate…
CVE-2026-70190 - CVSS 7.3 (high), 2026-10-13: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-70197 - CVSS 8.1 (high), 2026-10-13: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70161 - CVSS 7.3 (high), 2026-10-13: Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-70181 - CVSS 7.5 (high), 2026-10-13: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70188 - CVSS 9.1 (critical), 2026-10-13: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature…
CVE-2026-70196 - CVSS 5.9 (medium), 2026-10-13: Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70159 - CVSS 7.5 (high), 2026-10-13: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70165 - CVSS 6.7 (medium), 2026-10-13: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-70179 - CVSS 7.5 (high), 2026-10-13: Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-70194 - CVSS 6.5 (medium), 2026-10-13: Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-70175 - CVSS 8.1 (high), 2026-10-13: Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-70174 - CVSS 8.8 (high), 2026-10-13: Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70186 - CVSS 7.5 (high), 2026-10-13: Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-87697 - CVSS 8.8 (high), 2026-10-13: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-85790 - CVSS 5.9 (medium), 2026-10-13: Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVE-2026-69651 - CVSS 7.5 (high), 2026-10-13: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-66822 - CVSS 5.9 (medium), 2026-10-13: Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-103572 - CVSS 8.8 (high), 2026-10-13: Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized…
CVE-2026-69806 - CVSS 7 (high), 2026-09-08: Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-71328 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2026-69304 - CVSS 5.9 (medium), 2026-09-08: Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-69805 - CVSS 8.1 (high), 2026-09-08: External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-58649 - CVSS 6.5 (medium), 2026-09-08: Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-69439 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69522 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2026-62898 - CVSS 7.5 (high), 2026-08-11: Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVE-2026-70354 - CVSS 7.8 (high), 2026-08-11: Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-62886 - CVSS 7.8 (high), 2026-08-11: Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-62871 - CVSS 7.8 (high), 2026-08-11: Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-62909 - CVSS 7.8 (high), 2026-08-11: Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-62902 - CVSS 6.5 (medium), 2026-08-11: Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-62901 - CVSS 7.5 (high), 2026-08-11: Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-62900 - CVSS 5.9 (medium), 2026-08-11: Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-62899 - CVSS 5.9 (medium), 2026-08-11: Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a…
CVE-2026-62897 - CVSS 7 (high), 2026-08-11: Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
CVE-2026-50659 - CVSS 6.5 (medium), 2026-07-14: Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
CVE-2026-50651 - CVSS 7.5 (high), 2026-07-14: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-50650 - CVSS 7.8 (high), 2026-07-14: Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.
CVE-2026-50648 - CVSS 7.5 (high), 2026-07-14: Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50646 - CVSS 7.8 (high), 2026-07-14: Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.
CVE-2026-50528 - CVSS 8.2 (high), 2026-07-14: Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-50527 - CVSS 7.5 (high), 2026-07-14: Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50526 - CVSS 7 (high), 2026-07-14: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
CVE-2026-50525 - CVSS 7.5 (high), 2026-07-14: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-50524 - CVSS 7.5 (high), 2026-07-14: Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-47305 - CVSS 7.8 (high), 2026-07-14: Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.
CVE-2026-47304 - CVSS 9.8 (critical), 2026-07-14: Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-47303 - CVSS 8.8 (high), 2026-07-14: Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-47302 - CVSS 7.5 (high), 2026-07-14: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-47300 - CVSS 8.8 (high), 2026-07-14: Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-32177 - CVSS 7.3 (high), 2026-05-12: Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-32175 - CVSS 4.3 (medium), 2026-05-12: A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could…
CVE-2026-32203 - CVSS 7.5 (high), 2026-04-14: Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
CVE-2026-32178 - CVSS 7.5 (high), 2026-04-14: Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-21256 - CVSS 8.8 (high), 2026-02-10: Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to…
CVE-2026-21257 - CVSS 8 (high), 2026-02-10: Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an authorized attacker to…
CVE-2025-62214 - CVSS 6.7 (medium), 2025-11-11: Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally.
CVE-2025-55248 - CVSS 5.7 (medium), 2025-10-14: Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.
CVE-2025-55240 - CVSS 7.3 (high), 2025-10-14: Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
CVE-2025-55315 - CVSS 9.9 (critical), 2025-10-14: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature…
CVE-2025-53773 - CVSS 7.8 (high), 2025-08-12: Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to…
CVE-2025-49739 - CVSS 8.8 (high), 2025-07-08: Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-47959 - CVSS 7.1 (high), 2025-06-13: Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a…
CVE-2025-30399 - CVSS 7.5 (high), 2025-06-13: Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2025-26646 - CVSS 8 (high), 2025-05-13: External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a…
CVE-2025-32703 - CVSS 5.5 (medium), 2025-05-13: Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally.
CVE-2025-32702 - CVSS 7.8 (high), 2025-05-13: Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to execute code locally.
CVE-2025-29802 - CVSS 7.3 (high), 2025-04-08: Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
CVE-2025-29804 - CVSS 7.3 (high), 2025-04-08: Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
CVE-2025-26682 - CVSS 7.5 (high), 2025-04-08: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2025-25003 - CVSS 7.3 (high), 2025-03-11: Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
CVE-2025-24998 - CVSS 7.3 (high), 2025-03-11: Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
CVE-2025-24070 - CVSS 7 (high), 2025-03-11: Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-21206 - CVSS 7.3 (high), 2025-02-11: Visual Studio Installer Elevation of Privilege Vulnerability