Microsoft Visual Studio 2022 Version 17.14 vulnerabilities, page 3
90 vulnerabilities
Known vulnerabilities in Microsoft Visual Studio 2022 Version 17.14, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-58280chainguarddotnet-bootstrap-8+34
EPSS score1.10%
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-105016ubuntudotnet7+15EPSS score0.99%
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.CVE-2026-102870ubuntudotnet10+7EPSS score0.78%
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.CVE-2026-102869microsoftmicrosoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2+8EPSS score0.74%
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.CVE-2025-55248chainguarddotnet-bootstrap-8+37EPSS score0.72%
Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.CVE-2025-55315chainguardazure-functions-extension-bundles-4+34EPSS score66.53%
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.CVE-2025-55240microsoftmicrosoft visual studio 2017 version 15.9 (includes 15.0 - 15.8)+7EPSS score0.37%
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.CVE-2025-62214microsoftmicrosoft visual studio 2022 version 17.14+1EPSS score1.11%
Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally.CVE-2025-47959microsoftmicrosoft visual studio 2022 version 17.10+4EPSS score10.94%
Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a network.CVE-2025-53773microsoftmicrosoft visual studio 2022 version 17.14+1EPSS score3.24%
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.CVE-2025-49739microsoftmicrosoft visual studio 2015 update 3+10EPSS score0.95%
Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.CVE-2025-30399chainguarddotnet-bootstrap-8+72EPSS score1.07%
Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.CVE-2026-21256microsoftmicrosoft visual studio 2022 version 17.14+2EPSS score1.18%
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code over a network.CVE-2026-21257microsoftmicrosoft visual studio 2022 version 17.14+2EPSS score0.90%
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an authorized attacker to elevate privileges over a network.CVE-2026-71328ubuntudotnet7+10EPSS score0.76%
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.CVE-2026-62871ubuntudotnet7+10EPSS score0.47%
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.CVE-2026-62901chainguarddotnet-bootstrap-8+26EPSS score1.23%
Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-62886ubuntudotnet7+19EPSS score0.47%
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.CVE-2026-62902ubuntudotnet7+10EPSS score0.87%
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.CVE-2026-62900chainguarddotnet-sdk-10.0.2+15EPSS score0.75%
Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.