Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

The Microsoft .NET Core SDK installations on the remote host are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a     network. (CVE-2026-70175)

  - Improper access control in .NET allows an authorized attacker to elevate privileges locally.
    (CVE-2026-105544)

  - Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a     network. (CVE-2026-114151)

  - Stack-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a     network. (CVE-2026-114152)

  - Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate     privileges locally. (CVE-2026-114155)

  - Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
    (CVE-2026-114158, CVE-2026-114159, CVE-2026-118745)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core installations on the remote host are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Stack-based buffer overflow in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-109475)

  - Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a     network. (CVE-2026-114151)

  - Stack-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a     network. (CVE-2026-114152)

  - Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
    (CVE-2026-114158, CVE-2026-114159, CVE-2026-118745)

  - Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-118747)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a
    network. (CVE-2026-114159)

ID	Name	Product	Family	Type	Severity
380358	Security Update for Microsoft .NET Core SDK (November 2026)	Nessus	Windows	Local	high
380356	Security Update for Microsoft .NET Core (November 2026)	Nessus	Windows	Local	high
478927	SCA: security update for Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-x86 (GHSA-3cgx-w6gm-fqrx)	Tenable Cloud Security	SCA Checks	Local	high
478927	SCA: security update for Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-x86 (GHSA-3cgx-w6gm-fqrx)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-114159

high

Tenable Plugins

high

high

high

high