High WID-SEC-2026-0367 5 CVEs

Microsoft DeveloperTools (Visual Studio Code und .NET): Mehrere Schwachstellen

Published Feb 10, 2026 · Updated Apr 6, 2026 · Revision 4 · de-DE

Vendor: Microsoft Vendor: Ubuntu Product: .NET Framework Product: Linux Product: Visual Studio 2022 Product: Visual Studio Code Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio, Visual Studio Code und .NET ausnutzen, um sich erhöhte Rechte zu verschaffen, beliebigen Code auszuführen, Spoofing-Angriffe zu starten und die Authentifizierung zu umgehen.

Product

Visual Studio Code ist ein Quelltext-Editor von Microsoft.
Microsoft Visual Studio ist eine integrierte Entwicklungsumgebung für Hochsprachen.

Vulnerabilities 5

High 8.8

CVE-2026-21256

GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.3

Feb 10, 2026
High 8.8

CVE-2026-21518

GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Microsoft Visual Studio Code Microsoft Visual Studio Code CoPilot Chat Extension

Feb 10, 2026
High 8.0

CVE-2026-21257

GitHub Copilot and Visual Studio Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.3

Feb 10, 2026
High 8.0

CVE-2026-21523

GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability

Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.

Microsoft Visual Studio Code Microsoft Visual Studio Code CoPilot Chat Extension

Feb 10, 2026
High 7.5

CVE-2026-21218

.NET Spoofing Vulnerability

Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.

Microsoft .NET 8.0 .NET 9.0 .NET 10.0 Ubuntu Alpine Wolfi NuGet

Feb 10, 2026

Revision history

2026-04-06 #4
Referenz(en) aufgenommen: ZDI-26-253, ZDI-CAN-29184
2026-02-16 #3
Neue Updates von Ubuntu aufgenommen
2026-02-11 #2
Neue Updates von Ubuntu aufgenommen
2026-02-10 #1
Initiale Fassung

References

Microsoft Leitfaden für Sicherheitsupdates
https://msrc.microsoft.com/update-guide/
Ubuntu Security Notice USN-8025-1 vom 2026-02-12
https://ubuntu.com/security/notices/USN-8025-1
Ubuntu Security Notice USN-8025-2 vom 2026-02-16
https://ubuntu.com/security/notices/USN-8025-2