CVE-2026-118745
Visual Studio Remote Code Execution Vulnerability
CVE-2026-118745 is a high vulnerability (CVSS 8.8) in Microsoft .net 10.0 Installed On Windows, published November 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.95%, the 61st percentile. Fixed in Microsoft.NETCore.App.Runtime.win-x86 8.0.34.
- Severity
- 8.8 HighCVSS 3.1, CVE List
- Exploit chance
- 0.95%EPSS, 61st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
8.0.34Microsoft.NETCore.App.Runtime.win-x86 +28 more
Description
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.NETCore.App.Runtime.win-x86NuGet | 8.0.0 up to 8.0.34 | 8.0.34 |
Microsoft.NETCore.App.Runtime.win-x64NuGet | 8.0.0 up to 8.0.34 | 8.0.34 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet | 8.0.0 up to 8.0.34 | 8.0.34 |
Microsoft.NETCore.App.Runtime.win-x86NuGet | 9.0.0 up to 9.0.23 | 9.0.23 |
Microsoft.NETCore.App.Runtime.win-x64NuGet | 9.0.0 up to 9.0.23 | 9.0.23 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet | 9.0.0 up to 9.0.23 | 9.0.23 |
Microsoft.NETCore.App.Runtime.win-x86NuGet | 10.0.0 up to 10.0.15 | 10.0.15 |
Microsoft.NETCore.App.Runtime.win-x64NuGet | 10.0.0 up to 10.0.15 | 10.0.15 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet | 10.0.0 up to 10.0.15 | 10.0.15 |
Microsoft.NETCore.App.Runtime.win-x86NuGet | 11.0.0-preview.1 up to 11.0.0 | 11.0.0 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
Microsoft.NETCore.App.Runtime.win-x64NuGet | 11.0.0-preview.1 up to 11.0.0 | 11.0.0 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet | 11.0.0-preview.1 up to 11.0.0 | 11.0.0 |
dotnet10-runtimeAlpine:v3.24 | before 10.0.15-r0 | 10.0.15-r0 |
dotnet8-runtimeAlpine:v3.22 | before 8.0.34-r0 | 8.0.34-r0 |
dotnet8-runtimeAlpine:v3.23 | before 8.0.34-r0 | 8.0.34-r0 |
dotnet8-runtimeAlpine:v3.24 | before 8.0.34-r0 | 8.0.34-r0 |
dotnet9-runtimeAlpine:v3.22 | before 9.0.23-r0 | 9.0.23-r0 |
dotnet9-runtimeAlpine:v3.23 | before 9.0.23-r0 | 9.0.23-r0 |
dotnet9-runtimeAlpine:v3.24 | before 9.0.23-r0 | 9.0.23-r0 |
Microsoft.NETCore.App.Runtime.win-x86NuGet | 8.0.0 up to 8.0.34, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 27 moreShow less8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.298.0.38.0.308.0.318.0.328.0.338.0.48.0.58.0.68.0.78.0.8 | 8.0.34 |
Microsoft.NETCore.App.Runtime.win-x64NuGet | 8.0.0 up to 8.0.34, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 27 moreShow less8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.298.0.38.0.308.0.318.0.328.0.338.0.48.0.58.0.68.0.78.0.8 | 8.0.34 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet | 8.0.0 up to 8.0.34, plus listed versions 8.0.18.0.108.0.118.0.128.0.13 Show 27 moreShow less8.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.298.0.38.0.308.0.318.0.328.0.338.0.48.0.58.0.68.0.78.0.8 | 8.0.34 |
Microsoft.NETCore.App.Runtime.win-x86NuGet | 9.0.0 up to 9.0.23, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 17 moreShow less9.0.149.0.159.0.169.0.179.0.189.0.199.0.29.0.209.0.219.0.229.0.39.0.49.0.59.0.69.0.79.0.89.0.9 | 9.0.23 |
Microsoft.NETCore.App.Runtime.win-x64NuGet | 9.0.0 up to 9.0.23, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 17 moreShow less9.0.149.0.159.0.169.0.179.0.189.0.199.0.29.0.209.0.219.0.229.0.39.0.49.0.59.0.69.0.79.0.89.0.9 | 9.0.23 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet | 9.0.0 up to 9.0.23, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 17 moreShow less9.0.149.0.159.0.169.0.179.0.189.0.199.0.29.0.209.0.219.0.229.0.39.0.49.0.59.0.69.0.79.0.89.0.9 | 9.0.23 |
Microsoft.NETCore.App.Runtime.win-x86NuGet | 10.0.0 up to 10.0.15, plus listed versions 10.0.110.0.1010.0.1110.0.1210.0.13 Show 9 moreShow less10.0.1410.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.9 | 10.0.15 |
Microsoft.NETCore.App.Runtime.win-x64NuGet | 10.0.0 up to 10.0.15, plus listed versions 10.0.110.0.1010.0.1110.0.1210.0.13 Show 9 moreShow less10.0.1410.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.9 | 10.0.15 |
Microsoft.NETCore.App.Runtime.win-arm64NuGet | 10.0.0 up to 10.0.15, plus listed versions 10.0.110.0.1010.0.1110.0.1210.0.13 Show 9 moreShow less10.0.1410.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.9 | 10.0.15 |
dotnet7Ubuntu:22.04:LTS | All versions, plus listed versions 7.0.105-0ubuntu1~22.04.17.0.107-0ubuntu1~22.04.17.0.108-0ubuntu1~22.04.17.0.109-0ubuntu1~22.04.17.0.110-0ubuntu1~22.04.1 Show 9 moreShow less7.0.111-0ubuntu1~22.04.17.0.112-0ubuntu1~22.04.17.0.113-0ubuntu1~22.04.17.0.114-0ubuntu1~22.04.17.0.115-0ubuntu1~22.04.17.0.116-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.27.0.119-0ubuntu1~22.04.1 | None known |
What each source reports
CVE List Score used
Visual Studio Remote Code Execution Vulnerability
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
- Record
CVE-2026-118745- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness
- CWE-122
- Updated
- 2026-11-10
EUVDEUVD-2026-122251
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
- Record
EUVD-2026-122251- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Updated
- 2026-11-11
GitHub AdvisoriesGHSA-cfv6-4v53-fff6
Duplicate Advisory: Microsoft Security Advisory CVE-2026-118745 - Visual Studio Remote Code Execution Vulnerability
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-x8x8-p968-x646. This link is maintained to preserve external references.
Original Description
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
- Record
GHSA-cfv6-4v53-fff6- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-11
GitHub AdvisoriesGHSA-x8x8-p968-x646
Microsoft Security Advisory CVE-2026-118745 - Visual Studio Remote Code Execution Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.
Crafted PDB line metadata can exceed the caller-provided buffer and cause a heap out-of-bounds write.
CVSS Details
- Version: 3.1
- Severity: High
- Score: 8.8 (base score)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-122
Affected Platforms
- Platforms: Windows
- Architectures: x86, x64, Arm64
<a name="affected-packages"></a>Affected Packages
On Windows x86, x64, and Arm64, Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 are affected when reading crafted native PDBs.
.NET on Windows
Product | Affected version | Patched version --- | --- | --- .NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34 .NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23 .NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15 .NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0
Windows self-contained runtime packs
These runtime packs deliver the .NET runtime for Windows self-contained applications.
Package | Affected version | Patched version --- | --- | --- Microsoft.NETCore.App.Runtime.win-x86 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-arm64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x86 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-arm64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x86 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-arm64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x86 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-x64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0
Windows SDK distributions
These Windows SDK distributions are affected through their bundled .NET runtime.
Product | Affected version | Patched version --- | --- | --- .NET SDK 8.0.1xx | >= 8.0.100-0, < 8.0.134 | 8.0.134 .NET SDK 8.0.4xx | >= 8.0.400-0, < 8.0.428 | 8.0.428 .NET SDK 9.0.1xx | >= 9.0.100-0, < 9.0.124 | 9.0.124 .NET SDK 9.0.3xx | >= 9.0.300-0, < 9.0.321 | 9.0.321 .NET SDK 10.0.1xx | >= 10.0.100-0, < 10.0.115 | 10.0.115 .NET SDK 10.0.4xx | >= 10.0.400-0, < 10.0.404 | 10.0.404 .NET SDK 11.0.1xx | >= 11.0.100-preview.1, < 11.0.100 | 11.0.100
Windows SDK updates
Update each installed SDK feature band to the following version or later:
- .NET SDK 8.0.1xx: 8.0.134
- .NET SDK 8.0.4xx: 8.0.428
- .NET SDK 9.0.1xx: 9.0.124
- .NET SDK 9.0.3xx: 9.0.321
- .NET SDK 10.0.1xx: 10.0.115
- .NET SDK 10.0.4xx: 10.0.404
- .NET SDK 11.0.1xx: 11.0.100
Advisory FAQ
<a name="how-affected"></a>How do I know if I am…
- Record
GHSA-x8x8-p968-x646- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness
- CWE-122
- Updated
- 2026-11-11
NVD
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
- Record
CVE-2026-118745- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-10
OSVALPINE-CVE-2026-118745
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
- Record
ALPINE-CVE-2026-118745- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVGHSA-cfv6-4v53-fff6
Duplicate Advisory: Microsoft Security Advisory CVE-2026-118745 - Visual Studio Remote Code Execution Vulnerability
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-x8x8-p968-x646. This link is maintained to preserve external references.
Original Description
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
- Record
GHSA-cfv6-4v53-fff6- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-11
OSVGHSA-x8x8-p968-x646
Microsoft Security Advisory CVE-2026-118745 - Visual Studio Remote Code Execution Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.
Crafted PDB line metadata can exceed the caller-provided buffer and cause a heap out-of-bounds write.
CVSS Details
- Version: 3.1
- Severity: High
- Score: 8.8 (base score)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness: CWE-122
Affected Platforms
- Platforms: Windows
- Architectures: x86, x64, Arm64
<a name="affected-packages"></a>Affected Packages
On Windows x86, x64, and Arm64, Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 are affected when reading crafted native PDBs.
.NET on Windows
Product | Affected version | Patched version --- | --- | --- .NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34 .NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23 .NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15 .NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0
Windows self-contained runtime packs
These runtime packs deliver the .NET runtime for Windows self-contained applications.
Package | Affected version | Patched version --- | --- | --- Microsoft.NETCore.App.Runtime.win-x86 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-arm64 | >= 8.0.0, < 8.0.34 | 8.0.34 Microsoft.NETCore.App.Runtime.win-x86 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-arm64 | >= 9.0.0, < 9.0.23 | 9.0.23 Microsoft.NETCore.App.Runtime.win-x86 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-arm64 | >= 10.0.0, < 10.0.15 | 10.0.15 Microsoft.NETCore.App.Runtime.win-x86 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-x64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0
Windows SDK distributions
These Windows SDK distributions are affected through their bundled .NET runtime.
Product | Affected version | Patched version --- | --- | --- .NET SDK 8.0.1xx | >= 8.0.100-0, < 8.0.134 | 8.0.134 .NET SDK 8.0.4xx | >= 8.0.400-0, < 8.0.428 | 8.0.428 .NET SDK 9.0.1xx | >= 9.0.100-0, < 9.0.124 | 9.0.124 .NET SDK 9.0.3xx | >= 9.0.300-0, < 9.0.321 | 9.0.321 .NET SDK 10.0.1xx | >= 10.0.100-0, < 10.0.115 | 10.0.115 .NET SDK 10.0.4xx | >= 10.0.400-0, < 10.0.404 | 10.0.404 .NET SDK 11.0.1xx | >= 11.0.100-preview.1, < 11.0.100 | 11.0.100
Windows SDK updates
Update each installed SDK feature band to the following version or later:
- .NET SDK 8.0.1xx: 8.0.134
- .NET SDK 8.0.4xx: 8.0.428
- .NET SDK 9.0.1xx: 9.0.124
- .NET SDK 9.0.3xx: 9.0.321
- .NET SDK 10.0.1xx: 10.0.115
- .NET SDK 10.0.4xx: 10.0.404
- .NET SDK 11.0.1xx: 11.0.100
Advisory FAQ
<a name="how-affected"></a>How do I know if I am…
- Record
GHSA-x8x8-p968-x646- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness
- CWE-122
- Updated
- 2026-11-11
OSVUBUNTU-CVE-2026-118745
Crafted PDB line metadata can exceed the caller-provided buffer and cause a heap out-of-bounds write.
- Record
UBUNTU-CVE-2026-118745- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-12
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, published, references | OSV | |
| published, references | EUVD | |
| published, references | EUVD | |
| affected, references | OSV | |
| affected, aliases, facts, references | GitHub Advisories | |
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, references | GitHub Advisories | |
| cwes, references, severity, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118745
nvd.nist.gov/vuln/detail/CVE-2026-118745
github.com/advisories/GHSA-cfv6-4v53-fff6
Show 15 moreShow less
security.alpinelinux.org/vuln/CVE-2026-118745
ubuntu.com/security/CVE-2026-118745
cve.org/CVERecord?id=CVE-2026-118745
devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates
Left out here: the rest of 2 source descriptions. The JSON record has them.