CVE-2026-69439: microsoft microsoft visual studio 2022 version 17.14 Heap-based Buffer Overflow
CVSS: 8.8v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-69439GHSA-527h-q9f6-p7qxBIT-dotnet-2026-69439BIT-dotnet-sdk-2026-69439
Published 08-09-2026Last modified 14-10-2026
Vulnerability summary
CVE-2026-69439 is a high (CVSS 8.8) Heap-based Buffer Overflow vulnerability in microsoft microsoft visual studio 2022 version 17.14. EPSS estimates a 0.84% chance of exploitation in the next 30 days, higher than 57.1% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
0.84%
0%100%
Low · +0.10 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 08-09-2026PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVSS metrics
4 scores · 4 sources · 1 versionHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:CSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · NugetEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.84%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
+0.10 pp
From 0.74% on 19-09-2026
19-09-202619-10-2026
EPSS score0.84%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Microsoft9 products
- microsoft visual studio 2022 version 17.14≥ 17.14.0, < 17.14.40
- microsoft visual studio 2026 version 18.9≥ 18.9.0, < 18.9.3
- .net≥ 8.0.0, < 8.0.31 | ≥ 9.0.0, < 9.0.20 | ≥ 10.0.0, < 10.0.12 | 11.0.0:preview1 | 11.0.0:preview2 | 11.0.0:preview3 | 11.0.0:preview4 | 11.0.0:preview5 | 11.0.0:preview6 | 11.0.0:preview7
- .net 10.0≥ 10.0.0, < 10.0.12
- .net 11.0≥ 11.0.0, < 11.0 RC1
NuGet1 product
- Microsoft.DiaSymReader.Native≥ 17.10.0-beta1.24272.1, < 18.9.0-beta1.26405.2
Ubuntu1 product
- dotnet7All versions (No fix recorded)
3 vendors · 11 products
References
8 links
- github.com/dotnet/runtimePACKAGE
