Microsoft Patches Visual Studio RCE and .NET Flaws Requiring More Than Runtime Updates

Microsoft released security updates addressing 25 vulnerabilities across .NET, ASP.NET Core and associated Visual Studio tooling, including code execution, privilege escalation, denial of service, information disclosure and security feature bypass. Three Visual Studio flaws—CVE-2026-114151, CVE-2026-114152 and CVE-2026-114159—each carry a CVSS score of 8.8 and allow unauthenticated attackers to execute code by persuading users to open specially crafted files. The vulnerabilities involve untrusted deserialization and stack- or heap-based memory corruption; technical analyses identify the native symbol reader Microsoft.DiaSymReader.Native as the component affected by the latter two. Microsoft rated all three Important, reported no known exploitation or prior public disclosure at release, and assessed exploitation as less likely. Other fixes address ASP.NET Core Identity token delivery, excessive CPU consumption in Minimal API validation, memory exhaustion in the SignalR Redis backplane, service-account isolation bypass, cookie disclosure and local privilege escalation in test tooling.

Administrators should deploy the applicable serviced releases—.NET 8.0.34, 9.0.23, 10.0.15 and 11.0.0—and Visual Studio updates, including the documented Visual Studio 2026 release 18.11.4, while verifying affected component and package versions rather than relying solely on the IDE version. Runtime updates alone are insufficient: CVE-2026-118741 requires updated ASP.NET Core Identity scaffolders or templates and separate repairs to existing generated application code, which can send token-bearing links to client-supplied addresses rather than stored account addresses. CVE-2026-118747 requires a separate System.Formats.Cbor package update, and affected SignalR Redis deployments need both package and runtime updates. Complete remediation also requires updating every affected installed SDK feature band, rebuilding and redeploying self-contained applications with patched runtimes, and restarting processes that loaded vulnerable components. Prioritize developer workstations processing untrusted projects or debugging artifacts and exposed applications using affected ASP.NET Core features.