CVE-2026-62886 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 37.68%

Affected Products (NVD)

Vendor	Product	Version
microsoft	visual_studio_2022	17.14.0 ≤ 𝑥 < 17.14.38
microsoft	visual_studio_2026	18.8.0 ≤ 𝑥 < 18.8.3
microsoft	.net	8.0.0 ≤ 𝑥 < 8.0.30
microsoft	.net	9.0.0 ≤ 𝑥 < 9.0.19
microsoft	.net	10.0.0 ≤ 𝑥 < 10.0.11

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows 10

1607 (x64, x86)	KB5123099
1607 (x64, x86)	KB5126047
1809 (arm64, x64, x86)	KB5126043
1809 (arm64, x64, x86)	KB5126421
21H2 (arm64, x64, x86)	KB5126046
21H2 (arm64, x64, x86)	KB5126421
22H2 (arm64, x64, x86)	KB5126046
22H2 (arm64, x64, x86)	KB5126421

Windows 11

23H2 (arm64, x64)	KB5126424
24H2 (arm64, x64)	KB5126052
25H2 (arm64, x64)	KB5126052
26H1 (arm64, x64)	KB5120747
26H1 (arm64, x64)	KB5126053

Windows Server 2012

Standard	KB5120716
Standard	KB5126044
Standard	KB5126049

Windows Server 2012 R2

Standard	KB5120695
Standard	KB5126045
Standard	KB5126051

Windows Server 2016

Standard	KB5123099
Standard	KB5126047

Windows Server 2019

Standard	KB5126043
Standard	KB5126048

Windows Server 2022

Standard	KB5126050
Standard	KB5126422

Windows Server 2025

Standard

Ubuntu Releases

Ubuntu Product

Codename

dotnet6

bionic	dne
focal	dne
jammy	not-affected
noble	dne
resolute	dne
trusty	dne
xenial	dne

dotnet7

bionic	dne
focal	dne
jammy	ignored
noble	dne
resolute	dne
trusty	dne
xenial	dne

dotnet8

bionic	dne
focal	dne
jammy	not-affected
noble	not-affected
resolute	dne
trusty	dne
xenial	dne

dotnet9

bionic	dne
focal	dne
jammy	dne
noble	dne
resolute	dne
trusty	dne
xenial	dne

dotnet10

bionic	dne
focal	dne
jammy	dne
noble	not-affected
resolute	not-affected
trusty	dne
xenial	dne

Common Weakness Enumeration

CWE-122 - Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62886