CVE-2026-70354 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 27.44%

Affected Products (NVD)

Vendor	Product	Version
microsoft	visual_studio_2022	17.14.0 ≤ 𝑥 < 17.14.38
microsoft	visual_studio_2026	18.8.0 ≤ 𝑥 < 18.8.3
microsoft	.net_framework	4.8.1
microsoft	.net_framework	4.8
microsoft	.net_framework	4.6.2
microsoft	.net_framework	4.7
microsoft	.net_framework	4.7.1
microsoft	.net_framework	4.7.2
microsoft	.net_framework	3.5
microsoft	.net_framework	4.7.2
microsoft	.net_framework	3.5
microsoft	.net_framework	4.8.1
microsoft	.net_framework	3.5
microsoft	.net_framework	4.8
microsoft	.net_framework	3.5
microsoft	.net_framework	4.6.2
microsoft	.net_framework	4.7
microsoft	.net_framework	4.7.1
microsoft	.net_framework	4.7.2
microsoft	.net_framework	3.5
microsoft	.net	8.0.0 ≤ 𝑥 < 8.0.30
microsoft	.net	9.0.0 ≤ 𝑥 < 9.0.19
microsoft	.net	10.0.0 ≤ 𝑥 < 10.0.11

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows 10

1607 (x64, x86)	KB5120702
1607 (x64, x86)	KB5120418
1809 (arm64, x64, x86)	KB5120703
1809 (arm64, x64, x86)	KB5120698
21H2 (arm64, x64, x86)	KB5120701
21H2 (arm64, x64, x86)	KB5120709
22H2 (arm64, x64, x86)	KB5120701
22H2 (arm64, x64, x86)	KB5120709

Windows 11

23H2 (arm64, x64)	KB5120713
24H2 (arm64, x64)	KB5120710
25H2 (arm64, x64)	KB5120708
26H1 (arm64, x64)	KB5120711
26H1 (arm64, x64)	KB5120747

Windows Server 2012

Server Core	KB5120699
Server Core	KB5120704
Server Core	KB5120716
Standard	KB5120699
Standard	KB5120704
Standard	KB5120716

Windows Server 2012 R2

Server Core	KB5120695
Server Core	KB5120700
Server Core	KB5120706
Standard	KB5120695
Standard	KB5120700
Standard	KB5120706

Windows Server 2016

Server Core	KB5120418
Server Core	KB5120702
Standard	KB5120418
Standard	KB5120702

Windows Server 2019

Server Core	KB5120698
Server Core	KB5120703
Standard	KB5120698
Standard	KB5120703

Windows Server 2022

Server Core	KB5120705
Server Core	KB5120714
Standard	KB5120705
Standard	KB5120714

Windows Server 2025

Server Core	KB5120708
Standard	KB5120708

Ubuntu Releases

Ubuntu Product

Codename

dotnet6

bionic	dne
focal	dne
jammy	not-affected
noble	dne
resolute	dne
trusty	dne
xenial	dne

dotnet7

bionic	dne
focal	dne
jammy	ignored
noble	dne
resolute	dne
trusty	dne
xenial	dne

dotnet8

bionic	dne
focal	dne
jammy	not-affected
noble	not-affected
resolute	dne
trusty	dne
xenial	dne

dotnet9

bionic	dne
focal	dne
jammy	dne
noble	dne
resolute	dne
trusty	dne
xenial	dne

dotnet10

bionic	dne
focal	dne
jammy	dne
noble	not-affected
resolute	not-affected
trusty	dne
xenial	dne

Common Weakness Enumeration

CWE-787 - Out-of-bounds Write
The software writes data past the end, or before the beginning, of the intended buffer.

Vulnerability Media Exposure

[GERMAN] Microsoft Developer Tools: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio Code, Microsoft Windows Server 2012, Microsoft Windows Server 2012 R2, Microsoft Windows Server 2016, Microsoft .NET Framework, Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft PowerShell, Microsoft Windows, Microsoft .NET, Microsoft Visual Studio 2022 und Microsoft Visual Studio 2026 ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.
Published: 2026-08-11T22:00:00+00:00

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70354