.NET and Visual Studio Remote Code Execution Vulnerability
Impact
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
Source excerpt · microsoftAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Microsoft · .NET 10.0
| Version / range | Source status |
|---|---|
| 10.0.0 to before 10.0.12 | affected |
Microsoft · .NET 11.0
| Version / range | Source status |
|---|---|
| 11.0.0 to before 11.0 RC1 | affected |
Microsoft · .NET 8.0
| Version / range | Source status |
|---|---|
| 8.0.0 to before 8.0.31 | affected |
Microsoft · .NET 9.0
| Version / range | Source status |
|---|---|
| 9.0.0 to before 9.0.20 | affected |
Microsoft · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
Platforms: Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows Server 2016
| Version / range | Source status |
|---|---|
| 3.0.0.0 to before 2.0.50727.8984 & 3.0.30729.8980 & 4.7.4145.0 | affected |
Microsoft · Microsoft .NET Framework 3.5 AND 4.7.2
Platforms: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for ARM64-based Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019
| Version / range | Source status |
|---|---|
| 4.7.0 to before 2.0.50727.9070 & 3.0.30729.9068 & 4.7.4145.0 | affected |
Microsoft · Microsoft .NET Framework 3.5 AND 4.8
Platforms: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for ARM64-based Systems, Windows 10 Version 1809 for x64-based Systems, Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems, Windows 10 Version 22H2 for 32-bit Systems, Windows 10 Version 22H2 for ARM64-based Systems, Windows 10 Version 22H2 for x64-based Systems, Windows Server 2019, Windows Server 2022
| Version / range | Source status |
|---|---|
| 4.8.0 to before 2.0.50727.9070 & 3.0.30729.9068 & 4.8.4806.0 | affected |
Microsoft · Microsoft .NET Framework 3.5 AND 4.8.1
Platforms: Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems, Windows 10 Version 22H2 for 32-bit Systems, Windows 10 Version 22H2 for ARM64-based Systems, Windows 10 Version 22H2 for x64-based Systems, Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows Server 2022, Windows Server 2025
| Version / range | Source status |
|---|---|
| 4.8.1 to before 2.0.50727.9183 & 3.0.30729.9169 & 4.8.9347.0 | affected |
Microsoft · Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2
Platforms: Windows Server 2012, Windows Server 2012 R2
| Version / range | Source status |
|---|---|
| 4.7.0 to before 4.7.4145.0 | affected |
Microsoft · Microsoft .NET Framework 4.8
Platforms: Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
| Version / range | Source status |
|---|---|
| 4.8.0 to before 4.8.4806.0 | affected |
Microsoft · Microsoft .NET Framework 4.8.1
Platforms: Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems
| Version / range | Source status |
|---|---|
| 4.8.0.0 to before 4.8.9347.0 | affected |
Microsoft · Microsoft Visual Studio 2022 version 17.14
| Version / range | Source status |
|---|---|
| 17.14.0 to before 17.14.40 | affected |
Microsoft · Microsoft Visual Studio 2026 version 18.9
| Version / range | Source status |
|---|---|
| 18.9.0 to before 18.9.3 | affected |
Original source description
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.