Code Injection in Visual Studio - CVE-2026-103572
Published: October 13, 2026
Vulnerability identifier: #VU154314
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-103572
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of code generation in Visual Studio Tools for Applications and SQL Server Management Studio when processing malicious prompts. A remote attacker can deliver a malicious prompt over the network that coerces backend components or integrated tools into running unintended commands to execute arbitrary code.
Exploitation requires a user to interact with Copilot.
Affected software
Visual Studio
How to mitigate CVE-2026-103572
Install security update from vendor's website.
Visual Studio - update to 17.14.42