Type Confusion in Visual Studio and Microsoft .NET Framework - CVE-2026-102869

Vulnerability details

The vulnerability allows a remote attacker to escalate privileges by executing code with the privileges of the affected process.

The vulnerability exists due to type confusion in the Portable PDB processing functionality of .NET and Visual Studio when processing specially crafted files. A remote attacker can convince a user or service to process a specially crafted Portable PDB file to escalate privileges by executing code with the privileges of the affected process.

Affected software

How to mitigate CVE-2026-102869

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102869
• https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows