8.8
High
CVE-2026-102870 Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute…
Description
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Visual Studio 2022 version 17.14 17.14 | 17.14.0 → < 17.14.43 | 17.14.43 |
| Microsoft Visual Studio 2026 version 18.10 18.10 | 18.10.0 → < 18.10.4 | 18.10.4 |
| Microsoft.AspNetCore.Components.WebAssembly.Server 10.0 | 10.0.0 → < 10.0.13 | 10.0.13 |
| .NET 10.0 installed on Linux 10.0 | 10.0.0 → < 10.0.403 | 10.0.403 |
| .NET 10.0 installed on Mac OS 10.0 | 10.0.0 → < 10.0.403 | 10.0.403 |
| .NET 10.0 installed on Windows 10.0 | 10.0.0 → < 10.0.403 | 10.0.403 |
| .NET 11.0 installed on Linux 11.0 | 11.0.0-preview.1 → < 11.0.100-rc.3 | 11.0.100-rc.3 |
| .NET 11.0 installed on Mac OS 11.0 | 11.0.0-preview.1 → < 11.0.100-rc.3 | 11.0.100-rc.3 |
| .NET 11.0 installed on Windows 11.0 | 11.0.0-preview.1 → < 11.0.100-rc.3 | 11.0.100-rc.3 |
Show the 4 other branches Hide the 4 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Visual Studio 2019 version 16.11 16.11 | 16.11.0 → < 16.11.61 | 16.11.61 |
| Microsoft Visual Studio 2026 version 18.11 18.11 | 18.11.0 → < 18.11.2 | 18.11.2 |
| Microsoft Visual Studio 2026 version 18.12 18.12 | 18.12.0 → latest | No fix stated |
| Microsoft.AspNetCore.Components.WebAssembly.DevServer 10.0 | earliest → < 10.0.14 | 10.0.14 |
References
- ASP.NET Core Remote Code Execution Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Microsoft Visual Studio 2022 version 17.14
The 92 CVEs of Microsoft Visual Studio 2022 version 17.14 →
CVE-2026-118147
Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network
7.4
High
CVE-2026-109468
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service…
7.5
High
CVE-2026-105016
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network
9.8
Critical
CVE-2026-70162
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests
5.9
Medium