The vulnerability arises from improper control of code generation (code injection) in Visual Studio Tools for Applications and SQL Server Management Studio. An attacker with network access can trigger the execution of arbitrary code within the context of the Visual Studio installation. This flaw permits a remote attacker to compromise the confidentiality, integrity, and availability of the affected system, effectively achieving remote code execution.

Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.10 are affected. The vulnerability also applies to components of SQL Server Management Studio that rely on the Visual Studio Tools for Applications framework. Systems running these specific product releases without the latest security updates are at risk.

The CVSS score of 8.8 indicates high severity. EPSS is not available, so the likelihood of exploitation cannot be quantified at present; however, the flaw is network‑based and does not require local privileges, making it attractive for attackers. The vulnerability is not listed in CISA’s KEV catalog, but the remote code execution capability and high score suggest it should be addressed promptly. To exploit the flaw, the attacker must craft a trigger that causes Visual Studio or SQL Server Management Studio to generate and execute malicious code, typically through a network‑accessible service or authenticated session.