High priorityDisclosed

Advisory · CVE-2026-103572

Code injection in Visual Studio Tools for Applications can run code

Visual Studio Tools for Applications has a code injection flaw a remote attacker can use to execute code when a victim interacts with crafted content. Microsoft rates it CVSS 3.1 8.8.

Advisory published October 13, 2026Independent summary
Vendor
Microsoft
Product
Visual Studio
Identifier / CWE
CVE-2026-103572
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

Opening the wrong project content can let an attacker inject code into tooling that runs with the developer's rights.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Attacker engages the component

    A remote or authorized attacker sends crafted content or requests to Visual Studio.

  2. 02Weakness triggers

    The component mishandles the input and the flaw takes effect.

  3. 03Impact lands

    The attacker gains the execution, elevation, or access the flaw allows.

What happened

Microsoft disclosed CVE-2026-103572 in its October 2026 update guide: a code injection weakness (CWE-94) in Visual Studio Tools for Applications and Visual Studio, including Visual Studio 2026 builds before 18.10.4 in Microsoft’s affected data.

Microsoft lists the affected releases and their patched build thresholds in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.

What to do

  1. Inventory every Visual Studio deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Visual Studio while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for crashes or unexpected execution when opening solutions from new sources.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Keep Visual Studio on the same patch cadence as the operating system. The IDE is part of the supply chain.