SB20261111136 - Multiple vulnerabilities in .NET
Published: November 11, 2026 Updated: November 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2026-114159)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the affected system.
The vulnerability exists due to a heap-based buffer overflow in Visual Studio when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code on the affected system.
2) Heap-based buffer overflow (CVE-ID: CVE-2026-118745)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the affected system.
The vulnerability exists due to a heap-based buffer overflow in Visual Studio when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code.
3) Stack-based buffer overflow (CVE-ID: CVE-2026-109475)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a stack-based buffer overflow in .NET when processing network-supplied input. A remote attacker can send specially crafted input over a network to cause a denial of service.
4) Stack-based buffer overflow (CVE-ID: CVE-2026-114151)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the affected system.
The vulnerability exists due to deserialization of untrusted data and a stack-based buffer overflow in Visual Studio when processing untrusted file content. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.
5) Stack-based buffer overflow (CVE-ID: CVE-2026-114152)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the affected system.
The vulnerability exists due to a stack-based buffer overflow in Visual Studio when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code on the affected system.
6) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-114155)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges and execute code with another user's permissions, gaining access to that user's data and resources.
The vulnerability exists due to a time-of-check time-of-use race condition in .NET when a resource changes between being checked and being used. A local user can win a race condition during an operation requiring user interaction to execute code with another user's permissions.
7) Heap-based buffer overflow (CVE-ID: CVE-2026-114158)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the affected system.
The vulnerability exists due to a heap-based buffer overflow in Visual Studio when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code on the affected system.
8) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2026-118746)
CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication through impersonation and read or modify network communications.
The vulnerability exists due to failure to fail securely in the .NET authentication feature when handling network communications associated with a victim's request. A remote attacker can position themselves in the logical network path between the target and the resource requested by the victim to bypass authentication through impersonation and read or modify network communications.
9) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-120796)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in .NET and System.Text.Json when processing network-supplied input. A remote attacker can submit specially crafted input that triggers excessive computational work to cause a denial of service.
Remediation
Install update from vendor's website.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-114159
- https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes-v18.11
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118745
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-109475
- https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-114151
- https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-114152
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-114155
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-114158
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118746
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-120796
- https://github.com/dotnet/runtime/security/advisories/GHSA-cpw3-h88j-9f6x