That interaction requirement matters: a network attack vector does not, in this case, mean exploitation happens simply because a machine is connected to a network. It also does not remove the need to patch. Microsoft lists customer action as required and provides fixes across the affected products.
What the vulnerability allows
According to Microsoft’s Security Response Center advisory, deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.
The advisory explicitly reconciles the network attack vector AV:N with the required user interaction UI:R: the attacker must get a user to open a specially crafted file to initiate remote code execution. For administrators, this makes file-handling behavior relevant alongside update deployment—not a substitute for it.
Microsoft supplies the following security classification and status:
| Field | Microsoft advisory value |
|---|---|
| CVE | CVE-2026-114151 |
| Exact title | Visual Studio Remote Code Execution Vulnerability |
| Severity | Important |
| CVSS base score | 8.8 |
| CVSS temporal score | 7.2 |
| Weakness identifiers | CWE-121, CWE-502 |
| Exploitation assessment | Exploitation Less Likely |
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
The complete supplied CVSS vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
“Exploitation Less Likely” is Microsoft’s assessment, not a guarantee that exploitation cannot occur. Likewise, the required file-opening step is an attack prerequisite, not a reason to leave affected installations unpatched.
Affected products and exact fixes
The affected-product list extends beyond the product named in the vulnerability title. Microsoft includes four .NET product entries on Windows as well as a Visual Studio entry. Consequently, an inventory limited to Visual Studio alone would not cover the complete advisory scope.
The following remediation instructions preserve Microsoft’s supplied KB-to-build mappings and fixed-version values:
.NET 10.0 installed on Windows
For .NET 10.0 installed on Windows, install KB5135241 to reach fixed build 10.0.115; install KB5135241 to reach fixed build 10.0.15; install KB5135241 to reach fixed build 10.0.404.
.NET 11.0 installed on Windows
For .NET 11.0 installed on Windows, update to fixed build 11.0.0 or later; update to fixed build 11.0.100 or later.
.NET 8.0 installed on Windows
For .NET 8.0 installed on Windows, install KB5135243 to reach fixed build 8.0.134; install KB5135243 to reach fixed build 8.0.34; install KB5135243 to reach fixed build 8.0.428.
.NET 9.0 installed on Windows
For .NET 9.0 installed on Windows, install KB5135242 to reach fixed build 9.0.124; install KB5135242 to reach fixed build 9.0.23; install KB5135242 to reach fixed build 9.0.321.
Microsoft Visual Studio 2026 version 18.12
For Microsoft Visual Studio 2026 version 18.12, update to fixed build 18.12.0 or later.
Practical implications for patch deployment
The useful operational distinction here is between fixing one application and covering every applicable affected-product entry. Microsoft’s mappings supply several fixed builds under individual .NET KBs. Those mappings should remain attached to their respective products when building deployment and verification records; one build number should not become a blanket completion target for the whole advisory.
Based on those mappings and Microsoft’s stated attack prerequisite, a sensible response is:
- Inventory against the full affected-product list. Include the listed .NET installations as well as the specified Visual Studio product.
- Apply the corresponding remediation. Use the product-specific KB or fixed-version target above rather than treating the vulnerability title as the deployment scope.
- Verify installed versions after deployment. Record the applicable fixed build for each affected installation. A successful update for one listed product does not establish that another listed product has been remediated.
- Reinforce caution around attacker-supplied files. Microsoft identifies opening a specially crafted file as the trigger. Avoiding untrusted files addresses that prerequisite while updates are being deployed, but does not replace the fixes.
These are operational conclusions drawn from the advisory’s product coverage and attack conditions, rather than additional claims about observed attacks.
Bottom line: CVE-2026-114151 requires user interaction, but carries a substantial remote-code-execution risk and explicit customer action. Patch the applicable Visual Studio and .NET installations, then verify them against their individual fixed-build mappings—not just the name at the top of the advisory.
Correction (November 11, 2026): The CVSS temporal score was listed as 7.7. The correct value is 7.2, computed from the advisory's own CVSS vector (E:U/RL:O/RC:C against the 8.8 base score).