CVE-2026-118147
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
CVE-2026-118147 is an improper certificate validation vulnerability in Visual Studio. An unauthorized attacker can exploit this flaw to perform spoofing over a network.
Risk Assessment
The organization may be exposed to spoofing of trusted network resources, potentially leading to data interception or unauthorized actions in the context of the Visual Studio user.
Recommendation
It is recommended to promptly install the latest Visual Studio update provided by the vendor that fixes the certificate validation flaw.
Other vulnerabilities in Visual Studio
See all- CVE-2021-36952High
Visual Studio Remote Code Execution Vulnerability. Details not available in the description.
- CVE-2026-77907High
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
- CVE-2026-77906High
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
- CVE-2026-71328High
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
- CVE-2026-69522High
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
- CVE-2026-47305High
A protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally. The vulnerability can be exploited through local access to the system.
- CVE-2025-62214Medium
A command injection vulnerability in Visual Studio allows an authorized attacker to execute code locally. It stems from improper neutralization of special elements used in commands.
- CVE-2024-30052Medium
A remote code execution vulnerability in Visual Studio allows an attacker to execute arbitrary code in the context of the logged-in user. Exploitation requires user interaction, such as opening a specially crafted project file.
- CVE-2024-29060Medium
Elevation of privilege vulnerability in Visual Studio. An attacker could exploit this flaw to gain elevated privileges on the system.
- CVE-2023-33139Medium
A vulnerability in Visual Studio allows for information disclosure, potentially leading to unauthorized access to sensitive data.
Original NVD description (English source)
Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

