---
id: "CVE-2026-118745"
page: "https://infrastack.ai/live/CVE-2026-118745"
kind: "vulnerability"
aliases: ["CVE-2026-118745"]
title: "Visual Studio 2026 and .NET: heap buffer overflow lets an attacker run code over a network (user interaction needed)"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Microsoft Visual Studio 2026 18.11", "fixed": ["18.11.4"], "affected": ">= 18.11.0, < 18.11.4", "ecosystem": "vendor"}, {"name": "Microsoft Visual Studio 2026 18.12", "fixed": ["18.12.0"], "affected": "18.12.0 (record range unclear)", "ecosystem": "vendor"}, {"name": ".NET 8.0 on Windows", "fixed": ["8.0.34"], "affected": ">= 8.0.0, < 8.0.34", "ecosystem": "vendor"}, {"name": ".NET 9.0 on Windows", "fixed": ["9.0.23"], "affected": ">= 9.0.0, < 9.0.23", "ecosystem": "vendor"}, {"name": ".NET 10.0 on Windows", "fixed": ["10.0.15"], "affected": ">= 10.0.0, < 10.0.15", "ecosystem": "vendor"}, {"name": ".NET 11.0 on Windows", "fixed": ["11.0.0"], "affected": ">= 11.0.0-preview.1, < 11.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dotnet", "other", "rce", "visual-studio", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:19:51+00:00"
first_seen_at: "2026-11-10T19:24:55+00:00"
updated_at: "2026-11-10T22:59:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118745", "first_seen_at": "2026-11-10T19:24:55+00:00"}, {"source": "analyst", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118745", "first_seen_at": "2026-11-10T22:59:53+00:00", "cites": ["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118745", "https://app.opencve.io/cve/CVE-2026-118745", "https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/"]}]
exploit_sources: []
---

# Visual Studio 2026 and .NET: heap buffer overflow lets an attacker run code over a network (user interaction needed)

Link for people: https://infrastack.ai/live/CVE-2026-118745 (this .md is for agents)

Microsoft's November 2026 update fixes a heap-based buffer overflow (CWE-122) listed as Visual Studio Remote Code Execution, CVSS 8.8 (AV:N/AC:L/PR:N/UI:R). The record also lists .NET 8, 9, 10 and 11 on Windows. The vulnerable feature is not stated in any page I could read. No exploitation or public PoC found; not in KEV.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Visual Studio 2026 18.11 affected >= 18.11.0, < 18.11.4 fixed 18.11.4
- vendor:Microsoft Visual Studio 2026 18.12 affected 18.12.0 (record range unclear) fixed 18.12.0
- vendor:.NET 8.0 on Windows affected >= 8.0.0, < 8.0.34 fixed 8.0.34
- vendor:.NET 9.0 on Windows affected >= 9.0.0, < 9.0.23 fixed 9.0.23
- vendor:.NET 10.0 on Windows affected >= 10.0.0, < 10.0.15 fixed 10.0.15
- vendor:.NET 11.0 on Windows affected >= 11.0.0-preview.1, < 11.0.0 fixed 11.0.0

## How to check

Visual Studio 2026: Help > About or Visual Studio Installer; 18.11.x below 18.11.4 is listed as affected. For 18.12 the record gives an unclear range (below 18.12.0), so update 18.12 to the latest build. .NET on Windows: run dotnet --list-runtimes and dotnet --list-sdks; affected is 8.0 below 8.0.34, 9.0 below 9.0.23, 10.0 below 10.0.15, 11.0 previews (below 11.0.0).

## Fix

Visual Studio 2026 18.11.4 or later (18.12.0 released Nov 10 2026); .NET 8.0.34, 9.0.23, 10.0.15, 11.0.0. Source: Microsoft CNA record via OpenCVE; the MSRC page itself did not render.

## Timeline

- 2026-11-10T19:24:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118745
- 2026-11-10T22:59:53+00:00 analyst https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118745 — MSRC page is JS-only and did not render; affected/fixed versions from Microsoft CNA record (OpenCVE mirror) and .NET Nov 2026 servicing blog. Triggering feature unknown. Nothing marked verified.

## Documents

- [advisory] MSRC: CVE-2026-118745 Visual Studio Remote Code Execution Vulnerability (page did not render) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118745
- [describes] OpenCVE: CVE-2026-118745 (mirrors Microsoft CNA record) https://app.opencve.io/cve/CVE-2026-118745
- [fix] .NET and .NET Framework November 2026 servicing updates https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/

## From the sources

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_