Description
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
Published: 2026-09-08
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

This vulnerability is a heap-based buffer overflow in Visual Studio that allows an unauthorized attacker to execute code over a network. The flaw can lead to arbitrary code execution, compromising the confidentiality, integrity, and availability of the affected systems.

Affected Systems

Microsoft .NET 8.0, .NET 9.0, .NET 10.0, .NET 11.0, and Microsoft Visual Studio 2022 version 17.14 as well as Microsoft Visual Studio 2026 version 18.9 are impacted. Users running any of these release lines should consult the Microsoft Security Update Guide to verify their installation status.

Risk and Exploitability

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers are likely able to exploit the weakness remotely via the network, but no detailed exploit path is disclosed in the available data. Given the high impact and lack of an alternative mitigation, the risk remains substantial.

Generated by OpenCVE AI on September 9, 2026 at 00:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Download and apply the latest security updates for Microsoft .NET 8.0, 9.0, 10.0, 11.0 and Visual Studio 2022 17.14 and Visual Studio 2026 18.9 from the Microsoft Security Update Guide.
  • Configure firewall rules or network segmentation to prevent unauthorized external connections to Visual Studio services.
  • Implement runtime protection measures such as stack canaries, address space layout randomization, and data execution prevention on all affected systems to reduce overflow exploitation risk.

Generated by OpenCVE AI on September 9, 2026 at 00:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-63gh-g2x5-x69v Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability
History

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows
CPEs cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:-:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Microsoft windows

Wed, 09 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
Title .NET and Visual Studio Remote Code Execution Vulnerability
First Time appeared Microsoft
Microsoft .net
Microsoft visual Studio 2022
Microsoft visual Studio 2026
Weaknesses CWE-122
CPEs cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft .net
Microsoft visual Studio 2022
Microsoft visual Studio 2026
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft .net Visual Studio 2022 Visual Studio 2026 Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-09-25T21:37:58.606Z

Reserved: 2026-08-05T18:41:50.333Z

Link: CVE-2026-71328

cve-icon Vulnrichment

Updated: 2026-09-09T09:53:51.453Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-08T18:20:12.160

Modified: 2026-09-11T20:27:40.167

Link: CVE-2026-71328

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-09T18:30:13Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow