Microsoft Visual Studio 2022
155 CVEs affecting Microsoft Visual Studio 2022. Latest disclosed: 2026-10-13. Critical: 4, High: 119.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-55315 | Critical | 9.9 | 2025-10-14 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature ove… |
CVE-2024-43498 | Critical | 9.8 | 2024-11-12 | .NET and Visual Studio Remote Code Execution Vulnerability |
CVE-2026-88092 | Critical | 9.4 | 2026-10-13 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a ne… |
CVE-2024-0057 | Critical | 9.1 | 2024-01-09 | NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability |
CVE-2026-96957 | High | 8.8 | 2026-10-13 | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-71328 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2026-69439 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-47303 | High | 8.8 | 2026-07-14 | Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
CVE-2026-47300 | High | 8.8 | 2026-07-14 | Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
CVE-2026-21256 | High | 8.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to exec… |
CVE-2025-49739 | High | 8.8 | 2025-07-08 | Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-21178 | High | 8.8 | 2025-01-14 | Visual Studio Remote Code Execution Vulnerability |
CVE-2024-28938 | High | 8.8 | 2024-04-09 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2024-28937 | High | 8.8 | 2024-04-09 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2024-28936 | High | 8.8 | 2024-04-09 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2024-28935 | High | 8.8 | 2024-04-09 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2024-28934 | High | 8.8 | 2024-04-09 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2024-28933 | High | 8.8 | 2024-04-09 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2024-28932 | High | 8.8 | 2024-04-09 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |
CVE-2024-28931 | High | 8.8 | 2024-04-09 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability |