Executive brief
A security vulnerability exists in Microsoft .NET and Visual Studio, which are widely used frameworks and tools for building and running applications. An attacker could exploit this flaw to run unauthorized code on a user's computer if the user is tricked into opening a specially crafted file or data stream. This could lead to a full system compromise, allowing the attacker to steal data, install malware, or disrupt operations.
Technical details
A deserialization vulnerability (CWE-502) exists in Microsoft .NET and Visual Studio. The flaw occurs when the software processes untrusted data without sufficient validation, allowing an attacker to trigger the execution of arbitrary code. While the attack vector is local, it requires user interaction, such as a user opening a malicious file. Successful exploitation grants the attacker the same privileges as the current user, potentially leading to a complete compromise of the affected system. Microsoft has released security updates for .NET 8.0, 9.0, and various versions of Visual Studio to address this issue.
Affected products
- Microsoft .NET 8.0 8.0.0 to 8.0.29
- Microsoft .NET 9.0 9.0.0 to 9.0.18
- Microsoft Visual Studio 2022 version 17.12 17.12.0 to 17.12.22
- Microsoft Visual Studio 2022 version 17.14 17.14.0 to 17.14.36
- Microsoft Visual Studio 2026 version 18.7 18.0 to 18.7.4
Timeline
- 2026-07-14: disclosed: Initial publication of the CVE record and Microsoft advisory.