# Microsoft Visual Studio vulnerabilities Source: https://junglewise.ai/threats/technologies/visual-studio Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 01:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/visual-studio.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 43 vulnerabilities in Microsoft Visual Studio: 9 in the last 7 days and 24 in the last 90 days, 4 of them critical and 2 exploited in the wild. The most recent, Microsoft Visual Studio heap buffer overflow RCE, was published on 10 November 2026. 10 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. ## Counts - Last 7 days: 9 - Last 30 days: 10 - Last 90 days: 24 - All time: 43 (4 critical, 2 exploited in the wild) ## About Microsoft Visual Studio Microsoft's integrated development environment for building applications. ## Latest Microsoft Visual Studio vulnerabilities - [Microsoft Visual Studio heap buffer overflow RCE](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-224be73b) (high, CVSS 8.8, published 10 Nov 2026) - [Microsoft Visual Studio heap-based buffer overflow](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-6a4b9d28) (high, CVSS 8.8, published 10 Nov 2026) - [Microsoft Visual Studio stack-based buffer overflow](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-d956164d) (high, CVSS 8.8, published 10 Nov 2026) - [Microsoft Visual Studio deserialization remote code execution](https://junglewise.ai/threats/duplicate-advisory-microsoft-security-advisory-visual-studio-remote-1eb2f932) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-118745: Microsoft Visual Studio heap buffer overflow RCE](https://junglewise.ai/threats/cve-2026-118745-heap-based-buffer-overflow-in-visual-studio-allows-an) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-114159: Microsoft Visual Studio heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-114159-heap-based-buffer-overflow-in-visual-studio-allows-an) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-114158: Microsoft Visual Studio heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-114158-heap-based-buffer-overflow-in-visual-studio-allows-an) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-114152: Microsoft Visual Studio stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-114152-stack-based-buffer-overflow-in-visual-studio-allows-an) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-114151: Microsoft Visual Studio insecure deserialization code execution](https://junglewise.ai/threats/cve-2026-114151-deserialization-of-untrusted-data-in-visual-studio-allows-an) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-118147: Microsoft Visual Studio improper certificate validation spoofing](https://junglewise.ai/threats/cve-2026-118147-improper-certificate-validation-in-visual-studio-allows-an) (high, CVSS 7.4, published 31 Oct 2026) - [CVE-2026-96957: .NET cryptographic signature verification bypass](https://junglewise.ai/threats/cve-2026-96957-improper-verification-of-cryptographic-signature-in-net-allows-an) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-96235: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.](https://junglewise.ai/threats/cve-2026-96235-microsoft-security-advisory-net-and-visual-studio-remote-code) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-96234: Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.](https://junglewise.ai/threats/cve-2026-96234-microsoft-security-advisory-net-and-visual-studio-information) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-96222: Microsoft .NET certificate validation bypass in Cryptography.Xml](https://junglewise.ai/threats/cve-2026-96222-microsoft-security-advisory-net-spoofing-vulnerability) (high, CVSS 7.4, published 13 Oct 2026) - [CVE-2026-88092: Microsoft ASP.NET Core Kestrel HTTP request smuggling](https://junglewise.ai/threats/cve-2026-88092-microsoft-security-advisory-asp-net-core-security-feature-bypass) (critical, CVSS 9.4, published 13 Oct 2026) - [CVE-2026-85790: Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.](https://junglewise.ai/threats/cve-2026-85790-microsoft-security-advisory-net-information-disclosure) (medium, CVSS 5.9, published 13 Oct 2026) - [CVE-2026-70197: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.](https://junglewise.ai/threats/cve-2026-70197-microsoft-security-advisory-net-and-visual-studio-remote-code) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-70007: Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.](https://junglewise.ai/threats/cve-2026-70007-microsoft-security-advisory-net-and-visual-studio-remote-code) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-102869: .NET and Visual Studio type confusion privilege elevation](https://junglewise.ai/threats/cve-2026-102869-access-of-resource-using-incompatible-type-type-confusion-in-net) (high, CVSS 8.8, published 13 Oct 2026) - [Microsoft .NET and Visual Studio heap buffer overflow elevation of privilege](https://junglewise.ai/threats/microsoft-net-and-visual-studio-heap-buffer-overflow-elevation-of-02f3702a) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-77907: Microsoft Visual Studio heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-77907-microsoft-visual-studio-heap-based-buffer-overflow) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-77906: Microsoft Visual Studio heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-77906-microsoft-visual-studio-heap-based-buffer-overflow) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-71328: Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.](https://junglewise.ai/threats/cve-2026-71328-microsoft-diasymreader-native-heap-buffer-overflow) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-69439: Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.](https://junglewise.ai/threats/cve-2026-69439-microsoft-diasymreader-native-heap-overflow-in-pdb-parsing) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-70354: Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.](https://junglewise.ai/threats/cve-2026-70354-microsoft-net-out-of-bounds-write-in-windows-presentation) (high, CVSS 7.8, published 11 Aug 2026) ## Most severe Microsoft Visual Studio vulnerabilities - [CVE-2020-1147: .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2020-1147-microsoft-net-framework-sharepoint-and-visual-studio-remote-code) (critical, exploited in the wild, CVSS 3.1, published 24 May 2022) - [CVE-2023-38180: .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2023-38180-microsoft-net-core-and-visual-studio-denial-of-service) (critical, exploited in the wild, CVSS 3.1, published 9 Aug 2023) - [CVE-2026-88092: Microsoft ASP.NET Core Kestrel HTTP request smuggling](https://junglewise.ai/threats/cve-2026-88092-microsoft-security-advisory-asp-net-core-security-feature-bypass) (critical, CVSS 9.4, published 13 Oct 2026) - [CVE-2026-40372: Microsoft ASP.NET Core privilege escalation via improper signature verification](https://junglewise.ai/threats/cve-2026-40372-microsoft-asp-net-core-privilege-escalation-via-improper) (critical, CVSS 9.1, published 21 Apr 2026) - [CVE-2026-114151: Microsoft Visual Studio insecure deserialization code execution](https://junglewise.ai/threats/cve-2026-114151-deserialization-of-untrusted-data-in-visual-studio-allows-an) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-118745: Microsoft Visual Studio heap buffer overflow RCE](https://junglewise.ai/threats/cve-2026-118745-heap-based-buffer-overflow-in-visual-studio-allows-an) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-114152: Microsoft Visual Studio stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-114152-stack-based-buffer-overflow-in-visual-studio-allows-an) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-114159: Microsoft Visual Studio heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-114159-heap-based-buffer-overflow-in-visual-studio-allows-an) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-114158: Microsoft Visual Studio heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-114158-heap-based-buffer-overflow-in-visual-studio-allows-an) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-69439: Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.](https://junglewise.ai/threats/cve-2026-69439-microsoft-diasymreader-native-heap-overflow-in-pdb-parsing) (high, CVSS 8.8, published 8 Sep 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 5 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 9 | 1 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 9 | 0 | 0 | ## Other Microsoft technologies - [Microsoft Windows](https://junglewise.ai/threats/technologies/windows): 2,362 vulnerabilities - [Microsoft Windows 10](https://junglewise.ai/threats/technologies/windows-10): 589 vulnerabilities - [Microsoft Windows 11 24h2](https://junglewise.ai/threats/technologies/windows-11-24h2): 565 vulnerabilities - [Microsoft Windows 11 25h2](https://junglewise.ai/threats/technologies/windows-11-25h2): 534 vulnerabilities - [Microsoft Windows Server 2025](https://junglewise.ai/threats/technologies/windows-server-2025): 534 vulnerabilities - [Microsoft Windows Server 2022](https://junglewise.ai/threats/technologies/windows-server-2022): 528 vulnerabilities - [Microsoft Windows Server 2019](https://junglewise.ai/threats/technologies/windows-server-2019): 521 vulnerabilities - [Microsoft Windows Server 2012](https://junglewise.ai/threats/technologies/windows-server-2012): 517 vulnerabilities - [Microsoft Windows 11](https://junglewise.ai/threats/technologies/windows-11): 494 vulnerabilities - [Microsoft Windows Server 2016](https://junglewise.ai/threats/technologies/windows-server-2016): 476 vulnerabilities - [Microsoft Windows 10 1809](https://junglewise.ai/threats/technologies/windows-10-1809): 380 vulnerabilities - [Microsoft Windows 10 21h2](https://junglewise.ai/threats/technologies/windows-10-21h2): 373 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Microsoft Visual Studio vulnerabilities", https://junglewise.ai/threats/technologies/visual-studio, 13 November 2026.