CVE-2026-105016: Microsoft Visual Studio 2022 Version 17.14
Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Affected products
- Microsoft Microsoft Visual Studio 2022 Version 17.14: from 17.14.0, before 17.14.42 (fixed in 17.14.42)
- Microsoft Microsoft Visual Studio 2026 Version 18.10: from 18.10.0, before 18.10.4 (fixed in 18.10.4)
- Microsoft Net 10.0: from 10.0.0, before 10.0.14 (fixed in 10.0.14)
- Microsoft Net 11.0: from 11.0.0, before 11.0.0-rc.2.26504.105 (fixed in 11.0.0-rc.2.26504.105)
- Microsoft Net 8.0: from 8.0.0, before 8.0.32 (fixed in 8.0.32)
- Microsoft Net 9.0: from 9.0.0, before 9.0.21 (fixed in 9.0.21)
- Microsoft Windows 11 Version 23h2: from 10.0.22631.0, before 10.0.22631.7652 (fixed in 10.0.22631.7652)
- Microsoft Windows 11 Version 24h2: from 10.0.26100.0, before 10.0.26100.9711 (fixed in 10.0.26100.9711)
- Microsoft Windows 11 Version 25h2: from 10.0.26200.0, before 10.0.26200.9711 (fixed in 10.0.26200.9711)
- Microsoft Windows 11 Version 26h1: from 10.0.28000.0, before 10.0.28000.3231 (fixed in 10.0.28000.3231)
- Microsoft Windows 11 Version 26h2: from 10.0.26300.0, before 10.0.26300.9711 (fixed in 10.0.26300.9711)
- Microsoft Windows Server 2022: from 10.0.20348.0, before 10.0.20348.5761 (fixed in 10.0.20348.5761)
- Microsoft Windows Server 2025: from 10.0.26100.0, before 10.0.26100.33650 (fixed in 10.0.26100.33650)
- Microsoft Windows Server 2025 Server Core Installation: from 10.0.26100.0, before 10.0.26100.33650 (fixed in 10.0.26100.33650)
Affected packages
Published 2026-10-13. Last modified 2026-10-16.