# CVE-2026-50649: Microsoft .NET and Visual Studio deserialization remote code execution

Source: https://junglewise.ai/threats/cve-2026-50649-microsoft-net-and-visual-studio-deserialization-remote-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-50649 · Severity: high · CVSS 7.8 · Published 2026-07-14

A security vulnerability exists in Microsoft .NET and Visual Studio, which are widely used frameworks and tools for building and running applications. An attacker could exploit this flaw to run unauthorized code on a user's computer if the user is tricked into opening a specially crafted file or data stream. This could lead to a full system compromise, allowing the attacker to steal data, install malware, or disrupt operations.

Technologies: [Microsoft Visual Studio 2022](https://junglewise.ai/threats/technologies/visual-studio-2022). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-50649 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50649 being exploited in the wild.

**How severe is CVE-2026-50649?** High severity, with a CVSS score of 7.8, published 14 July 2026.

**Which products and versions are affected?** Microsoft Visual Studio 2022 17.12.0 to 17.12.22.

**Is there a fix for CVE-2026-50649?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50649 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-50649?** Check whether you run Microsoft Visual Studio 2022 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A deserialization vulnerability (CWE-502) exists in Microsoft .NET and Visual Studio. The flaw occurs when the software processes untrusted data without sufficient validation, allowing an attacker to trigger the execution of arbitrary code. While the attack vector is local, it requires user interaction, such as a user opening a malicious file. Successful exploitation grants the attacker the same privileges as the current user, potentially leading to a complete compromise of the affected system. Microsoft has released security updates for .NET 8.0, 9.0, and various versions of Visual Studio to address this issue.

## Affected products

- Microsoft .NET 8.0 8.0.0 to 8.0.29
- Microsoft .NET 9.0 9.0.0 to 9.0.18
- Microsoft Visual Studio 2022 version 17.12 17.12.0 to 17.12.22
- Microsoft Visual Studio 2022 version 17.14 17.14.0 to 17.14.36
- Microsoft Visual Studio 2026 version 18.7 18.0 to 18.7.4

## Timeline

- 2026-07-14: disclosed: Initial publication of the CVE record and Microsoft advisory.

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50649](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50649)

## Related threats

- [.NET cryptographic signature verification bypass](https://junglewise.ai/threats/cve-2026-96957-improper-verification-of-cryptographic-signature-in-net-allows-an)
- [Microsoft .NET certificate validation bypass in Cryptography.Xml](https://junglewise.ai/threats/cve-2026-96222-microsoft-security-advisory-net-spoofing-vulnerability)
- [Microsoft ASP.NET Core Kestrel HTTP request smuggling](https://junglewise.ai/threats/cve-2026-88092-microsoft-security-advisory-asp-net-core-security-feature-bypass)
- [Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.](https://junglewise.ai/threats/cve-2026-85790-microsoft-security-advisory-net-information-disclosure)
- [Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.](https://junglewise.ai/threats/cve-2026-71328-microsoft-diasymreader-native-heap-buffer-overflow)