Race condition in Visual Studio - CVE-2026-114157
Published: November 11, 2026
Vulnerability identifier: #VU164969
CSH Severity: Low
CVSS v4: 7.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-114157
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges by bypassing service account isolation and accessing data or performing operations without the intended authorization.
The vulnerability exists due to improper synchronization in ASP.NET Core when concurrent operations access a shared resource. A local user can win a race condition to bypass the isolation intended to restrict an affected service to its own account and gain unauthorized access to data or operations exposed by that service.
Affected software
Visual Studio
How to mitigate CVE-2026-114157
Install security update from vendor's website.
Visual Studio - update to 17.14.45