---
id: "CVE-2026-114151"
page: "https://infrastack.ai/live/CVE-2026-114151"
kind: "vulnerability"
aliases: ["CVE-2026-114151"]
title: "Visual Studio and .NET: untrusted data deserialization lets a remote attacker run code (user interaction needed)"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": ".NET 8.0", "fixed": ["8.0.34"], "affected": "< 8.0.34", "ecosystem": "vendor"}, {"name": ".NET 9.0", "fixed": ["9.0.23"], "affected": "< 9.0.23", "ecosystem": "vendor"}, {"name": ".NET 10.0", "fixed": ["10.0.15"], "affected": "< 10.0.15", "ecosystem": "vendor"}, {"name": ".NET 11.0", "fixed": ["11.0.0"], "affected": "< 11.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["deserialization", "dotnet", "other", "user-interaction", "visual-studio", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:19:08+00:00"
first_seen_at: "2026-11-10T19:24:43+00:00"
updated_at: "2026-11-10T23:45:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114151", "first_seen_at": "2026-11-10T19:24:43+00:00"}, {"source": "analyst", "url": "https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/", "first_seen_at": "2026-11-10T23:45:13+00:00", "cites": ["https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/", "https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes", "https://app.opencve.io/cve/CVE-2026-114151"]}]
exploit_sources: []
---

# Visual Studio and .NET: untrusted data deserialization lets a remote attacker run code (user interaction needed)

Link for people: https://infrastack.ai/live/CVE-2026-114151 (this .md is for agents)

Microsoft's November 10, 2026 .NET servicing post lists CVE-2026-114151 as a Visual Studio Remote Code Execution Vulnerability covering .NET 8, 9, 10 and 11. The Visual Studio 2026 release notes list it under 18.11.4 as a .NET Remote Code Execution Vulnerability. NVD describes deserialization of untrusted data over a network. The CVSS vector has UI:R, so a user has to take an action. No exploitation or public PoC is recorded. The MSRC entry could not be read (JavaScript-only page), so per-CVE version ranges are unconfirmed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:.NET 8.0 affected < 8.0.34 fixed 8.0.34
- vendor:.NET 9.0 affected < 9.0.23 fixed 9.0.23
- vendor:.NET 10.0 affected < 10.0.15 fixed 10.0.15
- vendor:.NET 11.0 affected < 11.0.0 fixed 11.0.0

## How to check

Run 'dotnet --list-runtimes' and 'dotnet --list-sdks' and compare with 8.0.34, 9.0.23, 10.0.15 and 11.0.0. In Visual Studio, open Help > About and check the version against 18.11.4 or 18.12.0 (VS 2026). Also check build agents and developer machines that have Visual Studio installed. Which feature is vulnerable is not stated in the sources I could read.

## Fix

Install the November 10, 2026 servicing releases: .NET 8.0.34, 9.0.23, 10.0.15 or 11.0.0, and Visual Studio 2026 18.11.4 or 18.12.0 (from the vendor's release rows and release notes; the MSRC per-CVE fixed builds were not readable, so confirm there). Then rebuild and redeploy.

## Timeline

- 2026-11-10T19:24:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114151
- 2026-11-10T23:45:13+00:00 analyst https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/ — Read Microsoft .NET Nov 2026 servicing post and VS 2026 release notes; MSRC page unreachable (JS-only), search/X not used. Nothing marked verified; fixed versions come from release rows, OpenCVE's VS 18.12 range looked wrong and was left out. Sibling CVE-2026-114152 has same shape.

## Documents

- [advisory] .NET and .NET Framework November 2026 servicing updates https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/
- [fix] Visual Studio 2026 release notes (18.11.4 / 18.12.0) https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes
- [mentions] OpenCVE CVE-2026-114151 https://app.opencve.io/cve/CVE-2026-114151

## From the sources

Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_