For administrators, this is a development-tooling patching task that extends beyond checking the Visual Studio version alone. Microsoft’s affected-product information also lists .NET installations, each with its own fixed-build targets.
What the vulnerability allows
Microsoft describes the flaw as follows: “Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.”
The weakness is classified as CWE-122, a heap-based buffer overflow. Microsoft’s advisory clarifies how the network attack vector fits with the requirement for user interaction: an attacker must persuade a user to open a specially crafted file to initiate remote code execution.
That distinction matters. Network-reachable does not mean interaction-free in this advisory. The CVSS metrics identify the attack vector as AV:N, while UI:R explicitly requires user interaction. Treating this as an automatic compromise merely from being connected to a network would misrepresent Microsoft’s stated attack conditions.
Severity and advisory status
Microsoft’s supplied advisory records the following:
| Field | Value |
|---|---|
| CVE | CVE-2026-114158 |
| Exact title | Visual Studio Remote Code Execution Vulnerability |
| Severity | Important |
| CVSS base score | 8.8 |
| CVSS temporal score | 7.7 |
| Weakness | CWE-122 |
| Exploitation assessment | Exploitation Less Likely |
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
The base metrics describe a network attack with low attack complexity, no required privileges, required user interaction, unchanged scope, and high potential impacts on confidentiality, integrity, and availability.
Microsoft’s “Exploitation Less Likely” assessment is not a recommendation to leave affected software unpatched. It is an exploitation assessment; the advisory separately identifies customer action as required.
Affected products and exact fixes
Microsoft’s affected-product records, supporting KB entries, and Visual Studio release notes identify the following remediation targets. Keep each build associated with its named product rather than treating these numbers as a single upgrade sequence.
- .NET 10.0 installed on Windows
For .NET 10.0 installed on Windows, install KB5135241 to reach fixed build 10.0.115; install KB5135241 to reach fixed build 10.0.15; install KB5135241 to reach fixed build 10.0.404. - .NET 11.0 installed on Windows
For .NET 11.0 installed on Windows, update to fixed build 11.0.0 or later; update to fixed build 11.0.100 or later. - .NET 8.0 installed on Windows
For .NET 8.0 installed on Windows, install KB5135243 to reach fixed build 8.0.134; install KB5135243 to reach fixed build 8.0.34; install KB5135243 to reach fixed build 8.0.428. - .NET 9.0 installed on Windows
For .NET 9.0 installed on Windows, install KB5135242 to reach fixed build 9.0.124; install KB5135242 to reach fixed build 9.0.23; install KB5135242 to reach fixed build 9.0.321. - Microsoft Visual Studio 2026 version 18.11
For Microsoft Visual Studio 2026 version 18.11, update to fixed build 18.11.4 or later. - Microsoft Visual Studio 2026 version 18.12
For Microsoft Visual Studio 2026 version 18.12, update to fixed build 18.12.0 or later.
What Windows administrators should do
The practical lesson from Microsoft’s product matrix is straightforward: a Visual Studio version check alone is not a complete assessment of the listed affected software. The matrix includes both Visual Studio and .NET product entries, so an inventory should account for each applicable installation.
A sensible remediation workflow is:
- Inventory the listed products. Identify which affected Visual Studio and .NET entries are installed on each managed Windows PC.
- Match updates to the product entry. Use the exact KB-to-build mappings and Visual Studio fixed versions above.
- Verify the result after deployment. Compare the installed versions against the applicable fixed-build targets rather than relying solely on a successful deployment report.
- Maintain file-handling caution. Because Microsoft identifies opening an attacker-crafted file as the trigger, avoid opening unexpected or untrusted files while remediation is underway. This is a precaution, not a substitute for installing the fixes.
These operational recommendations follow from the advisory’s affected-product list and stated attack prerequisite; they are not additional vendor claims about exploitation.
Bottom line: CVE-2026-114158 requires user interaction, but its potential consequence is remote code execution. Apply the appropriate fixes, verify every applicable product entry, and do not let the Visual Studio headline obscure the .NET remediation work.