Microsoft Microsoft Visual Studio 2026 Version 18.9
9 CVEs affecting Microsoft Microsoft Visual Studio 2026 Version 18.9. Latest disclosed: 2026-09-08. Critical: 0, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-77907 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2026-77906 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2026-71328 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2026-69522 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2026-69439 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-69805 | High | 7.5 | 2026-09-08 | External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-69806 | High | 7.0 | 2026-09-08 | Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally. |
CVE-2026-58649 | Medium | 6.5 | 2026-09-08 | Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. |
CVE-2026-69304 | Medium | 5.9 | 2026-09-08 | Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network. |