Microsoft Microsoft Visual Studio 2026 Version 18.12
21 CVEs affecting Microsoft Microsoft Visual Studio 2026 Version 18.12. Latest disclosed: 2026-11-10. Critical: 1, High: 17.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-114146 | Critical | 9.0 | 2026-11-10 | Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
CVE-2026-118745 | High | 8.8 | 2026-11-10 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2026-114159 | High | 8.8 | 2026-11-10 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2026-114158 | High | 8.8 | 2026-11-10 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2026-114152 | High | 8.8 | 2026-11-10 | Stack-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2026-114151 | High | 8.8 | 2026-11-10 | Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2026-102870 | High | 8.8 | 2026-10-13 | Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network. |
CVE-2026-70197 | High | 8.1 | 2026-10-13 | Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. |
CVE-2026-70175 | High | 8.1 | 2026-10-13 | Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-118749 | High | 7.5 | 2026-11-10 | Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-118748 | High | 7.5 | 2026-11-10 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-114157 | High | 7.5 | 2026-11-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges… |
CVE-2026-114154 | High | 7.5 | 2026-11-10 | Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-114149 | High | 7.5 | 2026-11-10 | Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-114147 | High | 7.5 | 2026-11-10 | Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-109481 | High | 7.5 | 2026-11-10 | Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-109478 | High | 7.5 | 2026-11-10 | Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-105544 | High | 7.5 | 2026-11-10 | Improper access control in .NET allows an authorized attacker to elevate privileges locally. |
CVE-2026-114156 | Medium | 6.5 | 2026-11-10 | Improper input validation in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-109476 | Medium | 6.1 | 2026-11-10 | Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network. |