CVE-2026-114151
Visual Studio Remote Code Execution Vulnerability
CVE-2026-114151 is a high vulnerability (CVSS 8.8) in Microsoft .net 10.0 Installed On Windows, published November 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.49%, the 74th percentile. Fixed in Microsoft.NETCore.App.Runtime.win-x86 8.0.34.
- Severity
- 8.8 HighCVSS 3.1, CVE List
- Exploit chance
- 1.49%EPSS, 74th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
8.0.34Microsoft.NETCore.App.Runtime.win-x86 +28 more
Description
Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Discussion
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.NETCore.App.Runtime.win-x86NuGet | 8.0.0 up to 8.0.34 | 8.0.34 |
Microsoft.NETCore.App.Runtime.win-x64NuGet | 8.0.0 up to 8.0.34 | 8.0.34 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet | 8.0.0 up to 8.0.34 | 8.0.34 |
Microsoft.NETCore.App.Runtime.win-x86NuGet | 9.0.0 up to 9.0.23 | 9.0.23 |
Microsoft.NETCore.App.Runtime.win-x64NuGet | 9.0.0 up to 9.0.23 | 9.0.23 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet | 9.0.0 up to 9.0.23 | 9.0.23 |
Microsoft.NETCore.App.Runtime.win-x86NuGet | 10.0.0 up to 10.0.15 | 10.0.15 |
Microsoft.NETCore.App.Runtime.win-x64NuGet | 10.0.0 up to 10.0.15 | 10.0.15 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet | 10.0.0 up to 10.0.15 | 10.0.15 |
Microsoft.NETCore.App.Runtime.win-x86NuGet | 11.0.0-preview.1 up to 11.0.0 | 11.0.0 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
Microsoft.NETCore.App.Runtime.win-x64NuGet | 11.0.0-preview.1 up to 11.0.0 | 11.0.0 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet | 11.0.0-preview.1 up to 11.0.0 | 11.0.0 |
dotnet10-runtimeAlpine:v3.24 | before 10.0.15-r0 | 10.0.15-r0 |
dotnet8-runtimeAlpine:v3.22 | before 8.0.34-r0 | 8.0.34-r0 |
dotnet8-runtimeAlpine:v3.23 | before 8.0.34-r0 | 8.0.34-r0 |
dotnet8-runtimeAlpine:v3.24 | before 8.0.34-r0 | 8.0.34-r0 |
dotnet9-runtimeAlpine:v3.22 | before 9.0.23-r0 | 9.0.23-r0 |
dotnet9-runtimeAlpine:v3.23 | before 9.0.23-r0 | 9.0.23-r0 |
dotnet9-runtimeAlpine:v3.24 | before 9.0.23-r0 | 9.0.23-r0 |
Microsoft.NETCore.App.Runtime.win-x86NuGet | 8.0.0 up to 8.0.34, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 27 moreShow less8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.298.0.38.0.308.0.318.0.328.0.338.0.48.0.58.0.68.0.78.0.8 | 8.0.34 |
Microsoft.NETCore.App.Runtime.win-x64NuGet | 8.0.0 up to 8.0.34, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 27 moreShow less8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.298.0.38.0.308.0.318.0.328.0.338.0.48.0.58.0.68.0.78.0.8 | 8.0.34 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet | 8.0.0 up to 8.0.34, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 27 moreShow less8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.298.0.38.0.308.0.318.0.328.0.338.0.48.0.58.0.68.0.78.0.8 | 8.0.34 |
Microsoft.NETCore.App.Runtime.win-x86NuGet | 9.0.0 up to 9.0.23, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 17 moreShow less9.0.149.0.159.0.169.0.179.0.189.0.199.0.29.0.209.0.219.0.229.0.39.0.49.0.59.0.69.0.79.0.89.0.9 | 9.0.23 |
Microsoft.NETCore.App.Runtime.win-x64NuGet | 9.0.0 up to 9.0.23, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 17 moreShow less9.0.149.0.159.0.169.0.179.0.189.0.199.0.29.0.209.0.219.0.229.0.39.0.49.0.59.0.69.0.79.0.89.0.9 | 9.0.23 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet | 9.0.0 up to 9.0.23, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 17 moreShow less9.0.149.0.159.0.169.0.179.0.189.0.199.0.29.0.209.0.219.0.229.0.39.0.49.0.59.0.69.0.79.0.89.0.9 | 9.0.23 |
Microsoft.NETCore.App.Runtime.win-x86NuGet | 10.0.0 up to 10.0.15, plus listed versions 10.0.110.0.1010.0.1110.0.1210.0.13 Show 9 moreShow less10.0.1410.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.9 | 10.0.15 |
Microsoft.NETCore.App.Runtime.win-x64NuGet | 10.0.0 up to 10.0.15, plus listed versions 10.0.110.0.1010.0.1110.0.1210.0.13 Show 9 moreShow less10.0.1410.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.9 | 10.0.15 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet | 10.0.0 up to 10.0.15, plus listed versions 10.0.110.0.1010.0.1110.0.1210.0.13 Show 9 moreShow less10.0.1410.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.9 | 10.0.15 |
dotnet7Ubuntu:22.04:LTS | All versions, plus listed versions 7.0.105-0ubuntu1~22.04.17.0.107-0ubuntu1~22.04.17.0.108-0ubuntu1~22.04.17.0.109-0ubuntu1~22.04.17.0.110-0ubuntu1~22.04.1 Show 9 moreShow less7.0.111-0ubuntu1~22.04.17.0.112-0ubuntu1~22.04.17.0.113-0ubuntu1~22.04.17.0.114-0ubuntu1~22.04.17.0.115-0ubuntu1~22.04.17.0.116-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.27.0.119-0ubuntu1~22.04.1 | None known |
What each source reports
CVE List Score used
Visual Studio Remote Code Execution Vulnerability
Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.
- Record
CVE-2026-114151- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness
- CWE-502, CWE-121
- Updated
- 2026-11-10
EUVDEUVD-2026-121975
Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.
- Record
EUVD-2026-121975- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Updated
- 2026-11-11
GitHub AdvisoriesGHSA-fpxj-5c99-g7vj
Microsoft Security Advisory CVE-2026-114151 - Visual Studio Remote Code Execution Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.
A crafted PDB LF_DECIMAL payload can trigger an out-of-bounds stack write when processed by DIA.
CVSS Details
- Version: 3.1
- Severity: High
- Score: 8.8 (base score)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-502, CWE-121
Affected Platforms
- Platforms: Windows
- Architectures: x86, x64, Arm64
<a name="affected-packages"></a>Affected Packages
Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 are affected when reading constants from attacker-supplied PDBs through ISymUnmanagedConstant.GetValue. The .NET runtime's native stack-trace reading path does not call ISymUnmanagedConstant.GetValue. This excludes that invocation, not the .NET product as a whole.
.NET on Windows
Product | Affected version | Patched version --- | --- | --- .NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34 .NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23 .NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15 .NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0
Windows self-contained runtime packs
These runtime packs deliver the .NET runtime for Windows self-contained applications.
Package | Affected version | Patched version --- | --- | --- Microsoft.NETCore.App.Runtime.win-x86 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-arm64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x86 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-arm64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x86 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-arm64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x86 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-x64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0
Windows SDK distributions
These Windows SDK distributions are affected through their bundled .NET runtime.
Product | Affected version | Patched version --- | --- | --- .NET SDK 8.0.1xx | >= 8.0.100-0, < 8.0.134 | 8.0.134 .NET SDK 8.0.4xx | >= 8.0.400-0, < 8.0.428 | 8.0.428 .NET SDK 9.0.1xx | >= 9.0.100-0, < 9.0.124 | 9.0.124 .NET SDK 9.0.3xx | >= 9.0.300-0, < 9.0.321 | 9.0.321 .NET SDK 10.0.1xx | >= 10.0.100-0, < 10.0.115 | 10.0.115 .NET SDK 10.0.4xx | >= 10.0.400-0, < 10.0.404 | 10.0.404 .NET SDK 11.0.1xx | >= 11.0.100-preview.1, < 11.0.100 | 11.0.100
Windows SDK updates
Update each installed SDK feature band to the following version or later:
- .NET SDK 8.0.1xx: 8.0.134
- .NET SDK 8.0.4xx: 8.0.428
- .NET SDK 9.0.1xx:…
- Record
GHSA-fpxj-5c99-g7vj- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness
- CWE-121, CWE-502
- Updated
- 2026-11-11
GitHub AdvisoriesGHSA-mqcg-252r-5fj7
Duplicate Advisory: Microsoft Security Advisory CVE-2026-114151 - Visual Studio Remote Code Execution Vulnerability
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-fpxj-5c99-g7vj. This link is maintained to preserve external references.
Original Description
Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.
- Record
GHSA-mqcg-252r-5fj7- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-11
NVD
Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.
- Record
CVE-2026-114151- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-121, CWE-502
- Updated
- 2026-11-10
OSVALPINE-CVE-2026-114151
Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.
- Record
ALPINE-CVE-2026-114151- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVGHSA-fpxj-5c99-g7vj
Microsoft Security Advisory CVE-2026-114151 - Visual Studio Remote Code Execution Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.
A crafted PDB LF_DECIMAL payload can trigger an out-of-bounds stack write when processed by DIA.
CVSS Details
- Version: 3.1
- Severity: High
- Score: 8.8 (base score)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-502, CWE-121
Affected Platforms
- Platforms: Windows
- Architectures: x86, x64, Arm64
<a name="affected-packages"></a>Affected Packages
Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 are affected when reading constants from attacker-supplied PDBs through ISymUnmanagedConstant.GetValue. The .NET runtime's native stack-trace reading path does not call ISymUnmanagedConstant.GetValue. This excludes that invocation, not the .NET product as a whole.
.NET on Windows
Product | Affected version | Patched version --- | --- | --- .NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34 .NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23 .NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15 .NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0
Windows self-contained runtime packs
These runtime packs deliver the .NET runtime for Windows self-contained applications.
Package | Affected version | Patched version --- | --- | --- Microsoft.NETCore.App.Runtime.win-x86 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-arm64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x86 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-arm64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x86 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-arm64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x86 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-x64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0
Windows SDK distributions
These Windows SDK distributions are affected through their bundled .NET runtime.
Product | Affected version | Patched version --- | --- | --- .NET SDK 8.0.1xx | >= 8.0.100-0, < 8.0.134 | 8.0.134 .NET SDK 8.0.4xx | >= 8.0.400-0, < 8.0.428 | 8.0.428 .NET SDK 9.0.1xx | >= 9.0.100-0, < 9.0.124 | 9.0.124 .NET SDK 9.0.3xx | >= 9.0.300-0, < 9.0.321 | 9.0.321 .NET SDK 10.0.1xx | >= 10.0.100-0, < 10.0.115 | 10.0.115 .NET SDK 10.0.4xx | >= 10.0.400-0, < 10.0.404 | 10.0.404 .NET SDK 11.0.1xx | >= 11.0.100-preview.1, < 11.0.100 | 11.0.100
Windows SDK updates
Update each installed SDK feature band to the following version or later:
- .NET SDK 8.0.1xx: 8.0.134
- .NET SDK 8.0.4xx: 8.0.428
- .NET SDK 9.0.1xx:…
- Record
GHSA-fpxj-5c99-g7vj- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness
- CWE-121, CWE-502
- Updated
- 2026-11-11
OSVGHSA-mqcg-252r-5fj7
Duplicate Advisory: Microsoft Security Advisory CVE-2026-114151 - Visual Studio Remote Code Execution Vulnerability
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-fpxj-5c99-g7vj. This link is maintained to preserve external references.
Original Description
Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.
- Record
GHSA-mqcg-252r-5fj7- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-11
OSVUBUNTU-CVE-2026-114151
A crafted PDB LF_DECIMAL payload can trigger an out-of-bounds stack write when processed by DIA.
- Record
UBUNTU-CVE-2026-114151- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-12
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, published, references | OSV | |
| published | EUVD | |
| published | EUVD | |
| affected, references | OSV | |
| affected, aliases, facts, references | GitHub Advisories | |
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, references | GitHub Advisories | |
| cwes, references, severity, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114151
github.com/dotnet/runtime/security/advisories/GHSA-fpxj-5c99-g7vj
nvd.nist.gov/vuln/detail/CVE-2026-114151
Show 15 moreShow less
security.alpinelinux.org/vuln/CVE-2026-114151
ubuntu.com/security/CVE-2026-114151
cve.org/CVERecord?id=CVE-2026-114151
devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates
Left out here: the rest of 2 source descriptions. The JSON record has them.