CVE-2026-102869: .NET and Visual Studio Elevation of Privilege Vulnerability

Overview

Severity
High (CVSS 8.8)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Elevation of Privilege
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2026-Oct
Released
2026-10-13

Description

Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

FAQ

How could an attacker exploit this vulnerability? An attacker could exploit this vulnerability by convincing a user or service to process a specially crafted Portable PDB file. Successful exploitation could allow the attacker to execute code with the privileges of the affected process. What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain the privileges of the user account or service account running the affected process.

Affected Products (26)

Developer Tools

  • Microsoft Visual Studio 2022 version 17.14
  • Microsoft Visual Studio 2026 version 18.10
  • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607
  • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016
  • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019
  • Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 21H2
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 22H2
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022
  • Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012
  • Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2
  • Microsoft .NET Framework 4.8 on Windows 10 version 1607
  • Microsoft .NET Framework 4.8 on Windows Server 2012
  • Microsoft .NET Framework 4.8 on Windows Server 2012 R2
  • Microsoft .NET Framework 4.8 on Windows Server 2016
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 24H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 25H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025
  • Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 23H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H2

Security Updates (18)

Acknowledgments

Henrique Pereira with Microsoft, 41ae55e9310ff27fa6f26af4727e5590

Revision History

  • 2026-10-13: Information published.