Brief Summary: CVE-2026-114151, a Visual Studio and .NET Deserialization Remote Code Execution Flaw

Introduction

A deserialization flaw serviced in Microsoft's November 10, 2026 Patch Tuesday release can give an attacker code execution on a Windows machine once a user opens a crafted file handled by .NET or Visual Studio tooling. The CVE record lists Visual Studio 2026 alongside Windows installations of four .NET branches (8, 9, 10 and 11), so the exposure reaches well past the IDE into shared runtimes, SDKs and self-contained applications that ship their own runtime.

Technical information

Scoring and prerequisites

Microsoft, acting as CNA, scores CVE-2026-114151 at CVSS v3.1 8.8 (High), with a temporal score of 7.7. NVD currently lists the record as "Awaiting Enrichment" and has not published an independent score. The base vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The CNA record also carries the temporal elements:

E:U/RL:O/RC:C

Reading the vector:

• AV:N, network attack vector
• AC:L, low attack complexity
• PR:N, no privileges required
• UI:R, user interaction required
• S:U, scope unchanged
• C:H / I:H / A:H, high confidentiality, integrity and availability impact
• E:U / RL:O / RC:C, exploit maturity unproven, remediation level Official Fix, report confidence confirmed

Two points are easy to misread. First, PR:N does not cancel UI:R. The attacker needs no existing access, but a user still has to participate. Second, FIRST's CVSS specification describes the base score as intrinsic severity under reasonable worst-case assumptions, so 8.8 is not a probability of compromise.

Root cause

The record associates the bug with two weaknesses:

• CWE-502, Deserialization of Untrusted Data: MITRE defines this as deserializing untrusted data without sufficiently ensuring the resulting data is valid. Deserialization reconstructs program objects from a stored or transferred representation.
• CWE-121, Stack-based Buffer Overflow: writing beyond the end of a buffer allocated on the stack.

According to the MSRC advisory FAQ, exploitation requires a user to open a specially crafted file supplied by the attacker. That places the vulnerable code in the path where .NET or Visual Studio tooling reads data from a file and rebuilds it into objects. The fix therefore has to stop attacker-controlled file contents from either:

• choosing which objects or types get created during deserialization, or
• overflowing a fixed-size stack buffer while the data is parsed.

Microsoft has not identified the component, API, serializer, parsing routine, file extension, network protocol or payload structure involved, and the published material does not explain how the deserialization weakness relates causally to the stack overflow classification. Microsoft has shipped the fix only as binaries, with no public commit, pull request or diff, so we cannot show vulnerable code. Any more specific root-cause claim should be treated as speculation until Microsoft publishes its dotnet/announcements advisory.

Attack flow

Based on the advisory FAQ and the CVSS vector, the supported scenario looks like this:

1. The attacker prepares a file whose contents target the vulnerable deserialization or parsing path.
2. The file reaches the victim over a network (AV:N). The specific delivery channel is not disclosed.
3. A user on a Windows system with an affected .NET runtime or SDK, or Visual Studio 2026 version 18.12, opens the file (UI:R).
4. The tooling parses the file and reconstructs objects from it. Attacker-controlled data either influences which types are instantiated or overflows a fixed-size stack buffer.
5. The result is code execution with high confidentiality, integrity and availability impact within an unchanged scope. The sources do not establish the privileges of the resulting process.

No source we reviewed supports a narrower trigger, such as opening a specific project type or using a particular serializer.

Exploitation status

The CVE record includes a CISA SSVC assessment timestamped 2026-11-10T20:03:36.800942Z:

• Exploitation: none
• Automatable: no
• Technical Impact: total

No threat actor attribution, campaign, indicators of compromise or public proof of concept has been disclosed. That reflects what has been identified and does not guarantee that no attacks exist. The potential technical impact remains substantial.

Patch information

Microsoft fixed CVE-2026-114151 in its November 10, 2026 Patch Tuesday release. The CVE record tags each patch reference as both a vendor advisory and a patch, and MSRC lists the Remediation Level as Official Fix. The GitHub release notes for every fixed branch still point to a placeholder announcement (dotnet/announcements/issues/xxx), so the changed code is not available.

Fixed builds

• .NET 8.0 (Windows): vulnerable from 8.0.0 up to, not including, 8.0.34. Fixed in 8.0.34 (KB5135243). SDKs carrying the fixed runtime: 8.0.428, 8.0.134.
• .NET 9.0 (Windows): vulnerable from 9.0.0 up to, not including, 9.0.23. Fixed in 9.0.23 (KB5135242). SDKs: 9.0.321, 9.0.124.
• .NET 10.0 (Windows): vulnerable from 10.0.0 up to, not including, 10.0.15. Fixed in 10.0.15 (KB5135241). SDKs: 10.0.404, 10.0.115.
• .NET 11.0 (Windows): vulnerable from 11.0.0-preview.1 up to, not including, 11.0.0. Fixed in 11.0.0 (GA), per the 11.0.0 release notes. SDK: 11.0.100.
• Visual Studio 2026: 18.12 line. Fixed build 18.12.0, per the VS 2026 release notes, which includes SDK 11.0.100 and runtime 11.0.0.

The CVE record's Visual Studio entry lists 18.12.0 as both the inclusive start and the exclusive end of its interval, which does not form a usable range on its own. The patch guidance identifies 18.12.0 as the fixed build. We recommend confirming installed builds against the Visual Studio 2026 release notes.

How the fix is delivered

The change lives in the .NET runtime and its tooling, not in a single NuGet package. Each branch's release notes list CVE-2026-114151 among the release's security fixes, and the servicing release moves the whole package set to the new version: runtime, ASP.NET Core, Windows Desktop runtime, SDK tooling and Visual Studio.

• Developer machines: installing a fixed SDK is enough, since the release notes state the SDK includes a matching updated runtime.
• Framework-dependent apps: pick up the fix once the shared runtime on the host is updated.
• Self-contained apps: carry their own runtime copy and need to be rebuilt and republished against the patched version. This is standard .NET servicing behavior rather than something the advisory states.
• Visual Studio 2026: move to 18.12.0.

Official downloads linked from Microsoft's servicing notice: .NET 8.0, .NET 9.0, .NET 10.0, .NET 11.0.

No CVE-specific workaround, configuration switch, registry change or compensating control has been published.

Corrections to circulating patch claims

Some upstream checks claimed the fix ships in ".NET 9 package line 9.0.24" and "Visual Studio 2022 17.14". The primary sources do not support either:

• The 9.0.24 note in Microsoft's servicing blog applies only to CVE-2026-118747, a separate System.Formats.Cbor package fix. For CVE-2026-114151, the fixed .NET 9 build is 9.0.23.
• Neither the MSRC advisory nor the CVE record lists Visual Studio 2022. The only Visual Studio product listed is Visual Studio 2026 version 18.12.

Affected systems and versions

• .NET 8.0 installed on Windows: 8.0.0 through any build before 8.0.34
• .NET 9.0 installed on Windows: 9.0.0 through any build before 9.0.23
• .NET 10.0 installed on Windows: 10.0.0 through any build before 10.0.15
• .NET 11.0 installed on Windows: 11.0.0-preview.1 through any build before 11.0.0
• Microsoft Visual Studio 2026 version 18.12: fixed build 18.12.0, with the record's interval inconsistency noted above

Configuration notes:

• The product labels explicitly name Windows installations of .NET. The sources do not establish equivalent exposure for Linux or macOS.
• Visual Studio Code is a separate, cross-platform editor and is not listed. Do not treat it as interchangeable with the Visual Studio IDE when scoping assets.
• Visual Studio 2022 is not listed in the advisory or the CVE record.
• Self-contained .NET applications built against a vulnerable runtime remain affected until rebuilt, even after the host's shared runtime is patched.

Vendor security history

Microsoft is a widely deployed vendor whose Visual Studio product spans Community, Professional and Enterprise editions, from individual developers to large organizations. The most relevant independent review of its security posture is the Cyber Safety Review Board's report on the Summer 2023 Microsoft Exchange Online intrusion, which concluded the intrusion was preventable and that Microsoft's security culture was inadequate, citing failures in protecting cryptographic signing material and in token validation.

Microsoft's July 2026 Secure Future Initiative progress report describes its response: embedding security into culture, governance and engineering, applying Zero Trust principles to platforms and engineering pipelines, and adding stronger identity controls, explicit tenant boundaries, secure engineering defaults and continuous validation. These are Microsoft's own reported improvements. Neither that report nor the Exchange review has any mechanical connection to this deserialization bug. They are organizational context only.

References

• NVD entry for CVE-2026-114151
• CVE.org record for CVE-2026-114151
• CVE record JSON (cveawg.mitre.org)
• MSRC Security Update Guide: CVE-2026-114151
• .NET and .NET Framework November 2026 servicing updates, .NET Blog
• .NET 8.0.34 release notes
• .NET 9.0.23 release notes
• .NET 10.0.15 release notes
• .NET 11.0.0 release notes
• Visual Studio 2026 release notes, Microsoft Learn
• GovCERT.HK Security Alert A26 11 02: Multiple Vulnerabilities in Microsoft Products
• What Is Visual Studio?, Microsoft Learn
• Visual Studio edition comparison
• CWE-502: Deserialization of Untrusted Data
• CWE-121: Stack-based Buffer Overflow
• CVSS v3.1 Specification Document, FIRST
• SFI Progress Report July 2026, Microsoft Trust Center
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• DHS: Cyber Safety Review Board releases report on Microsoft Online Exchange incident