The crucial detail for developers and IT administrators: this is a network-vector vulnerability, but exploitation requires a user to open a specially crafted file supplied by an attacker. That makes file-handling precautions relevant—but they are not a substitute for installing the applicable fixes.
What the vulnerability allows
Microsoft describes the issue as follows: “Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.”
The weakness is classified as CWE-122, a heap-based buffer overflow. This is a memory-safety problem; the security consequence identified by Microsoft is remote code execution.
Microsoft’s advisory specifically clarifies the relationship between the network attack vector and required user interaction: AV:N identifies a network attack vector, while UI:R means user interaction is required. In this case, a user must open an attacker’s specially crafted file to initiate remote code execution.
That distinction matters operationally. Reading “network” as “an attacker can compromise the machine without anyone opening anything” would misstate this advisory. Conversely, the need for user interaction does not make the vulnerability harmless: opening files is routine work on a development workstation.
Severity and exploitation assessment
Microsoft’s security information lists:
| Field | Value |
|---|---|
| CVE | CVE-2026-114159 |
| Exact title | Visual Studio Remote Code Execution Vulnerability |
| Severity | Important |
| CVSS base score | 8.8 |
| CVSS temporal score | 7.7 |
| Weakness | CWE-122 |
| Exploitation assessment | Exploitation Less Likely |
The complete supplied CVSS vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Its base metrics describe a network attack with low complexity, no required privileges, required user interaction, unchanged scope, and high potential impact on confidentiality, integrity, and availability.
Microsoft also records these statuses:
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
Those are the advisory’s reported statuses, not guarantees about future activity. “Exploitation Less Likely” is an assessment of exploitation likelihood; it does not cancel the requirement to update.
Affected products and exact remediation
Microsoft’s affected-product information covers six product entries. The following preserves the product-specific remediation and every supplied KB-to-build mapping.
.NET 10.0 installed on Windows
For .NET 10.0 installed on Windows, install KB5135241 to reach fixed build 10.0.115; install KB5135241 to reach fixed build 10.0.15; install KB5135241 to reach fixed build 10.0.404.
.NET 11.0 installed on Windows
For .NET 11.0 installed on Windows, update to fixed build 11.0.0 or later; update to fixed build 11.0.100 or later.
.NET 8.0 installed on Windows
For .NET 8.0 installed on Windows, install KB5135243 to reach fixed build 8.0.134; install KB5135243 to reach fixed build 8.0.34; install KB5135243 to reach fixed build 8.0.428.
.NET 9.0 installed on Windows
For .NET 9.0 installed on Windows, install KB5135242 to reach fixed build 9.0.124; install KB5135242 to reach fixed build 9.0.23; install KB5135242 to reach fixed build 9.0.321.
Microsoft Visual Studio 2026 version 18.11
For Microsoft Visual Studio 2026 version 18.11, update to fixed build 18.11.4 or later.
Microsoft Visual Studio 2026 version 18.12
For Microsoft Visual Studio 2026 version 18.12, update to fixed build 18.12.0 or later.
What administrators should verify
The practical takeaway from Microsoft’s affected-product list is that checking only the Visual Studio version is not a complete remediation check. The advisory also identifies .NET installations on Windows, with their own fixed-build mappings.
A useful deployment checklist is:
- Inventory against all six affected-product entries. Determine which listed products are present rather than relying solely on the vulnerability’s Visual Studio title.
- Apply each applicable product-specific remediation. Keep the KB and fixed-build relationships above intact when preparing deployment records.
- Verify installed versions after deployment. A completed update job should be followed by confirmation that each applicable product reaches its listed fixed build.
- Reinforce caution around unexpected files. Microsoft identifies opening an attacker-crafted file as the required interaction. Treat that as an interim exposure-reduction measure, not proof that an unpatched machine is protected.
The bottom line is straightforward: patch the affected development components, then verify the resulting builds. The user-interaction requirement helps explain the attack path; the separate .NET and Visual Studio entries explain why remediation needs more than a single version check.