CVE-2026-32203: microsoft microsoft visual studio 2022 version 17.12 Stack-based Buffer Overflow
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2026-32203GHSA-6588-8gv4-xfghBIT-dotnet-2026-32203BIT-dotnet-sdk-2026-32203
Published 14-04-2026Last modified 15-10-2026
Vulnerability summary
CVE-2026-32203 is a high (CVSS 7.5) Stack-based Buffer Overflow vulnerability in microsoft microsoft visual studio 2022 version 17.12. EPSS estimates a 2.44% chance of exploitation in the next 30 days, higher than 84% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
2.44%
0%100%
Low · +0.55 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 17 · Related 2Timeline
- 14-04-2026PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
CVSS metrics
4 scores · 4 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:CSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NugetEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.44%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
+0.55 pp
From 1.90% on 19-09-2026
19-09-202619-10-2026
EPSS score2.44%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Microsoft9 products
- microsoft visual studio 2022 version 17.12≥ 17.12.0, < 17.12.19
- microsoft visual studio 2022 version 17.14≥ 17.14.0, < 17.14.30
- microsoft visual studio 2026 version 18.4≥ 18.4.0, < 18.4.4
- .net≥ 10.0.0, < 10.0.6 | ≥ 8.0.0, < 8.0.26 | ≥ 9.0.0, < 9.0.15
- .net 10.0≥ 10.0.0, < 10.0.6
Ubuntu5 products
- dotnet10< 10.0.106-10.0.6-0ubuntu1~24.04.1 | < 10.0.106-10.0.6-0ubuntu1~25.10.1 | < 10.0.107-10.0.7-0ubuntu1~26.04.1
- dotnet6All versions (No fix recorded)
- dotnet7All versions (No fix recorded)
- dotnet8< 8.0.126-8.0.26-0ubuntu1~22.04.1 | < 8.0.126-8.0.26-0ubuntu1~24.04.1 | < 8.0.126-8.0.26-0ubuntu1~25.10.1
- dotnet9< 9.0.116-9.0.15-0ubuntu1~25.10.1
NuGet1 product
- System.Security.Cryptography.Xml≥ 10.0.0, < 10.0.6 | ≥ 9.0.0, < 9.0.15 | ≥ 8.0.0, < 8.0.3
3 vendors · 15 products
References
31 linksShow all 31 references
- github.com/dotnet/runtimePACKAGE