Is CVE-2026-50649 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50649 being exploited in the wild.

How severe is CVE-2026-50649?

High severity, with a CVSS score of 7.8, published 14 July 2026.

Which products and versions are affected?

Microsoft Visual Studio 2022 17.12.0 to 17.12.22.

Is there a fix for CVE-2026-50649?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-50649 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-50649?

Check whether you run Microsoft Visual Studio 2022 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50649: Microsoft .NET and Visual Studio deserialization remote code execution

CVE-2026-50649 · Severity: high · CVSS 7.8 · Published 2026-07-14

A security vulnerability exists in Microsoft .NET and Visual Studio, which are widely used frameworks and tools for building and running applications. An attacker could exploit this flaw to run unauthorized code on a user's computer if the user is tricked into opening a specially crafted file or data stream. This could lead to a full system compromise, allowing the attacker to steal data, install malware, or disrupt operations.

Technologies: Microsoft Visual Studio 2022. Vendors: Microsoft.

Quick answers

Is CVE-2026-50649 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50649 being exploited in the wild.
How severe is CVE-2026-50649?: High severity, with a CVSS score of 7.8, published 14 July 2026.
Which products and versions are affected?: Microsoft Visual Studio 2022 17.12.0 to 17.12.22.
Is there a fix for CVE-2026-50649?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-50649 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-50649?: Check whether you run Microsoft Visual Studio 2022 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A deserialization vulnerability (CWE-502) exists in Microsoft .NET and Visual Studio. The flaw occurs when the software processes untrusted data without sufficient validation, allowing an attacker to trigger the execution of arbitrary code. While the attack vector is local, it requires user interaction, such as a user opening a malicious file. Successful exploitation grants the attacker the same privileges as the current user, potentially leading to a complete compromise of the affected system. Microsoft has released security updates for .NET 8.0, 9.0, and various versions of Visual Studio to address this issue.

Affected products

Microsoft .NET 8.0 8.0.0 to 8.0.29
Microsoft .NET 9.0 9.0.0 to 9.0.18
Microsoft Visual Studio 2022 version 17.12 17.12.0 to 17.12.22
Microsoft Visual Studio 2022 version 17.14 17.14.0 to 17.14.36
Microsoft Visual Studio 2026 version 18.7 18.0 to 18.7.4

Timeline

2026-07-14: disclosed: Initial publication of the CVE record and Microsoft advisory.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50649

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.