Visual Studio Buffer Overflow Vulnerability CVE-2026-71328 Confirmed
- Severity
- HIGH
- Affected component
- visual studio (nuget)
- Affected versions
- >= v9.0.19, <= v9.0.19 or >= v8.0.30, <= v8.0.30 or >= v11.0.0-preview.7, <= v11.0.0-preview.7 or >= v10.0.11, <= v10.0.11 or >= v9.0.18, <= v9.0.18 or >= v8.0.29, <= v8.0.29 or >= v11.0.0-preview.6, <= v11.0.0-preview.6 or >= v10.0.10, <= v10.0.10 or >= v9.0.17, <= v9.0.17 or >= v11.0.0-preview.5, <= v11.0.0-preview.5 or >= v10.0.9, <= v10.0.9 or >= v8.0.28, <= v8.0.28 or >= v11.0.0-preview.4, <= v11.0.0-preview.4 or >= v9.0.16, <= v9.0.16 or >= v8.0.27, <= v8.0.27 or >= v10.0.8, <= v10.0.8 or >= v10.0.7, <= v10.0.7 or >= v11.0.0-preview.3, <= v11.0.0-preview.3 or >= v10.0.6, <= v10.0.6 or >= v9.0.15, <= v9.0.15 or >= v8.0.26, <= v8.0.26 or >= v10.0.5, <= v10.0.5 or >= v9.0.14, <= v9.0.14 or >= v8.0.25, <= v8.0.25 or >= v11.0.0-preview.2, <= v11.0.0-preview.2 or >= v10.0.4, <= v10.0.4 or >= v11.0.0-preview.1, <= v11.0.0-preview.1 or >= v9.0.13, <= v9.0.13 or >= v8.0.24, <= v8.0.24 or >= v10.0.3, <= v10.0.3 or >= v9.0.12, <= v9.0.12 or >= v8.0.23, <= v8.0.23 or >= v10.0.2, <= v10.0.2 or >= v10.0.1, <= v10.0.1 or >= v9.0.11, <= v9.0.11 or >= v8.0.22, <= v8.0.22 or >= v10.0.0, <= v10.0.0
- Patched version
- Not yet available
A confirmed high severity vulnerability in Visual Studio allows unauthorized remote code execution. This affects multiple versions of Visual Studio.
What happened
A heap-based buffer overflow vulnerability has been confirmed in Visual Studio. This vulnerability, tracked as CVE-2026-71328, allows an unauthorized attacker to execute code over a network. The vulnerability was first flagged on 2026-09-08 and confirmed on 2026-09-11. It affects a wide range of Visual Studio versions, as detailed in the affected components section.
This vulnerability is a duplicate of GHSA-63gh-g2x5-x69v, as indicated by the advisory withdrawal. The affected components list includes specific version ranges for Visual Studio that are vulnerable. It is crucial for users to review this list to determine if their installations are at risk.
What to do about it
- Review the affected components list to determine if your Visual Studio installation is vulnerable.
- Monitor official sources for any updates or patches related to this vulnerability.
- Consider implementing network-level protections to mitigate the risk of remote code execution.
- Stay informed about any further developments or patches released by Microsoft.
How 0Day would have caught this
visual studio is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using any of the Visual Studio versions listed in the affected components section.
What should I do right now?
Review the affected components list to check your Visual Studio version. Monitor official sources for updates or patches.
Is there an official fix available?
No official fix has been published yet. Continue to monitor the sources for updates.
Sources
- [GHSA-2j8r-3c22-8565] Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability
- [GHSA-527h-q9f6-p7qx] Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability
- [GHSA-63gh-g2x5-x69v] Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability
- [GHSA-4qhr-qf46-fcrx] Duplicate Advisory: Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability
- The Agentic IDE Extension Blind Spot