CVE-2026-118745

HighCVSS 8.8/10Last modified Nov 10, 2026

Description

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Microsoft	.NET 10.0 installed on Windows	>= 10.0.0, < 10.0.15
Microsoft	.NET 11.0 installed on Windows	>= 11.0.0-preview.1, < 11.0.0
Microsoft	.NET 8.0 installed on Windows	>= 8.0.0, < 8.0.34
Microsoft	.NET 9.0 installed on Windows	>= 9.0.0, < 9.0.23
Microsoft	Microsoft Visual Studio 2026 version 18.11	>= 18.11.0, < 18.11.4
Microsoft	Microsoft Visual Studio 2026 version 18.12	>= 18.12.0, < 18.12.0

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118745

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1187466.8Not failing securely ('failing open') in .NET allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1187477.5Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-1187487.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-1187497.5Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-118755.3The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unaut CVE-2026-1187507.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-1187527.8FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.22 contain a heap buffer overflow vulnerability in the PBM RLE decoder o CVE-2026-1187537.8FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp that al CVE-2026-1187545.3Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthentica CVE-2026-1187557.2Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute s CVE-2026-1187565.5gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories o CVE-2026-1187576.5PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_