The key detail for developers and IT administrators: exploitation requires a user to open a specially crafted file supplied by an attacker. Although the vulnerability has a network attack vector, Microsoft’s advisory does not describe an interaction-free attack. That distinction matters when assessing exposure—but it does not remove the need to update.
What the vulnerability allows
Microsoft describes the issue as follows: “Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.”
The assigned weakness is CWE-122, a heap-based buffer overflow. The advisory specifically explains that the CVSS network attack vector (AV:N) operates alongside a user-interaction requirement (UI:R): a user must open the attacker’s specially crafted file to initiate remote code execution.
For administrators, the practical implication is that patch management and file-handling precautions address different parts of the risk. Updating addresses the vulnerability; avoiding untrusted files reduces opportunities to trigger it. The latter is not a replacement for the former.
Microsoft’s severity and exploitation assessment
| Field | Microsoft’s value |
|---|---|
| CVE | CVE-2026-118745 |
| Exact title | Visual Studio Remote Code Execution Vulnerability |
| Severity | Important |
| CVSS base score | 8.8 |
| CVSS temporal score | 7.7 |
| Weakness | CWE-122 |
| Exploitation assessment | Exploitation Less Likely |
Microsoft also records these statuses:
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
The complete supplied CVSS vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
The vector describes a network attack with low attack complexity, no privileges required, required user interaction, and unchanged scope. Its confidentiality, integrity, and availability impact metrics are all High.
“Exploitation Less Likely” is an assessment, not a guarantee. Likewise, the exploitation status records Microsoft’s assessment in the advisory; it is not a reason to leave affected installations unpatched.
Affected products and exact remediation
Microsoft’s affected-product records cover four .NET product entries and two Visual Studio product entries. The following preserves the vendor’s exact product names, KB-to-build mappings, and remediation values.
.NET 10.0 installed on Windows
For .NET 10.0 installed on Windows, install KB5135241 to reach fixed build 10.0.115; install KB5135241 to reach fixed build 10.0.15; install KB5135241 to reach fixed build 10.0.404.
.NET 11.0 installed on Windows
For .NET 11.0 installed on Windows, update to fixed build 11.0.0 or later; update to fixed build 11.0.100 or later.
.NET 8.0 installed on Windows
For .NET 8.0 installed on Windows, install KB5135243 to reach fixed build 8.0.134; install KB5135243 to reach fixed build 8.0.34; install KB5135243 to reach fixed build 8.0.428.
.NET 9.0 installed on Windows
For .NET 9.0 installed on Windows, install KB5135242 to reach fixed build 9.0.124; install KB5135242 to reach fixed build 9.0.23; install KB5135242 to reach fixed build 9.0.321.
Microsoft Visual Studio 2026 version 18.11
For Microsoft Visual Studio 2026 version 18.11, update to fixed build 18.11.4 or later.
Microsoft Visual Studio 2026 version 18.12
For Microsoft Visual Studio 2026 version 18.12, update to fixed build 18.12.0 or later.
What Windows administrators should verify
The useful operational distinction in Microsoft’s records is that the vulnerability title alone is not an adequate inventory filter. Searching only for Visual Studio installations would overlook the separately listed .NET products.
A practical remediation review should therefore:
- Inventory both product groups. Identify installed products matching the Visual Studio and .NET entries above.
- Match each installation to its applicable remediation. Keep each KB and fixed build associated with its listed product rather than treating the build numbers as interchangeable.
- Verify the resulting installed versions. Confirm remediation against the applicable fixed-build entry, rather than relying solely on an update deployment’s completion status.
- Reinforce caution around externally supplied files. Microsoft identifies opening a specially crafted attacker-provided file as the required trigger.
These are operational conclusions drawn from Microsoft’s affected-product list and attack description, not additional vendor requirements.
The bottom line: patch the listed Visual Studio and .NET installations, and verify coverage across both. The required file-opening step helps explain the attack path; the explicit customer-action requirement makes the response clear.