Microsoft Microsoft Visual Studio 2026 Version 18.10
43 CVEs affecting Microsoft Microsoft Visual Studio 2026 Version 18.10. Latest disclosed: 2026-10-13. Critical: 3, High: 31.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-105016 | Critical | 9.8 | 2026-10-13 | Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network. |
CVE-2026-88092 | Critical | 9.4 | 2026-10-13 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a ne… |
CVE-2026-70188 | Critical | 9.1 | 2026-10-13 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature o… |
CVE-2026-96957 | High | 8.8 | 2026-10-13 | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-96235 | High | 8.8 | 2026-10-13 | Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. |
CVE-2026-96230 | High | 8.8 | 2026-10-13 | Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a net… |
CVE-2026-96224 | High | 8.8 | 2026-10-13 | Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. |
CVE-2026-87697 | High | 8.8 | 2026-10-13 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. |
CVE-2026-85363 | High | 8.8 | 2026-10-13 | Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-83520 | High | 8.8 | 2026-10-13 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. |
CVE-2026-70174 | High | 8.8 | 2026-10-13 | Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network. |
CVE-2026-70035 | High | 8.8 | 2026-10-13 | Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network. |
CVE-2026-70007 | High | 8.8 | 2026-10-13 | Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network. |
CVE-2026-103572 | High | 8.8 | 2026-10-13 | Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attac… |
CVE-2026-102870 | High | 8.8 | 2026-10-13 | Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network. |
CVE-2026-102869 | High | 8.8 | 2026-10-13 | Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-70197 | High | 8.1 | 2026-10-13 | Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. |
CVE-2026-70175 | High | 8.1 | 2026-10-13 | Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-96231 | High | 7.8 | 2026-10-13 | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
CVE-2026-96225 | High | 7.8 | 2026-10-13 | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |