---
id: "CVE-2026-114152"
page: "https://infrastack.ai/live/CVE-2026-114152"
kind: "vulnerability"
aliases: ["CVE-2026-114152"]
title: "Visual Studio 2026 and .NET: stack buffer overflow lets a network attacker run code (needs user interaction)"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Visual Studio", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": ".NET 8.0", "fixed": ["8.0.34"], "affected": ">= 8.0.0, < 8.0.34", "ecosystem": "vendor"}, {"name": ".NET 9.0", "fixed": ["9.0.23"], "affected": ">= 9.0.0, < 9.0.23", "ecosystem": "vendor"}, {"name": ".NET 10.0", "fixed": ["10.0.15"], "affected": ">= 10.0.0, < 10.0.15", "ecosystem": "vendor"}, {"name": ".NET 11.0", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1, < 11.0.0", "ecosystem": "vendor"}, {"name": "Visual Studio 2026 18.12", "fixed": [], "affected": "18.12.0 (range as published is unclear)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["dotnet", "other", "rce", "user-interaction", "visual-studio", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:19:08+00:00"
first_seen_at: "2026-11-10T19:24:43+00:00"
updated_at: "2026-11-10T23:45:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114152", "first_seen_at": "2026-11-10T19:24:43+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114152", "first_seen_at": "2026-11-10T23:45:08+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-114152", "https://app.opencve.io/cve/CVE-2026-114152"]}]
exploit_sources: []
---

# Visual Studio 2026 and .NET: stack buffer overflow lets a network attacker run code (needs user interaction)

Link for people: https://infrastack.ai/live/CVE-2026-114152 (this .md is for agents)

Microsoft's CVE record describes a stack-based buffer overflow (CWE-121, with CWE-822 untrusted pointer dereference) that lets an unauthorized attacker run code over a network. CVSS 8.8 with user interaction required. Not known to be exploited; no public PoC found. The affected component is not described.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Visual Studio affected range not listed fixed no fixed version listed
- vendor:.NET 8.0 affected >= 8.0.0, < 8.0.34 fixed 8.0.34
- vendor:.NET 9.0 affected >= 9.0.0, < 9.0.23 fixed 9.0.23
- vendor:.NET 10.0 affected >= 10.0.0, < 10.0.15 fixed 10.0.15
- vendor:.NET 11.0 affected >= 11.0.0-preview.1, < 11.0.0 fixed 11.0.0
- vendor:Visual Studio 2026 18.12 affected 18.12.0 (range as published is unclear) fixed no fixed version listed

## How to check

Run 'dotnet --list-runtimes' and 'dotnet --list-sdks' and compare to the fixed .NET versions; in Visual Studio, Help > About shows the version (VS 2026 18.12 is listed). Confirm exact VS fixed build on the MSRC Update Guide entry, which could not be read here.

## Fix

Update .NET to 8.0.34, 9.0.23, 10.0.15 or 11.0.0 (per Microsoft's CNA record via NVD/OpenCVE). For Visual Studio 2026, update to the latest 18.12 servicing build; the exact fixed build is unconfirmed.

## Timeline

- 2026-11-10T19:24:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114152
- 2026-11-10T23:45:08+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-114152 — MSRC page is JS-only and unreadable; used Microsoft CNA record via NVD/OpenCVE. Affected list covers .NET and VS 2026 18.12, not only Visual Studio. Nothing verified; MSRC page not read. UI:R per CVSS vector.

## Documents

- [describes] NVD CVE-2026-114152 (CNA data from Microsoft) https://nvd.nist.gov/vuln/detail/CVE-2026-114152
- [mentions] OpenCVE CVE-2026-114152 (mirror of Microsoft CNA record) https://app.opencve.io/cve/CVE-2026-114152

## From the sources

Stack-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_