Public Proof-of-Concept Disclosed for CVE-2026-103572 Remote Code Execution in Visual Studio Copilot and SSMS

TL;DR

Microsoft released an October Patch Tuesday update to fix CVE-2026-103572, an Important remote code execution flaw in Visual Studio Copilot. Furthermore, security researcher Johann Rehberger publicly disclosed the technical details and proof-of-concept exploit demonstrations for this Visual Studio Copilot RCE bug. The vulnerability carries a CVSS score of 8.8 and affects both Visual Studio and SQL Server Management Studio (SSMS).

Why CVE-2026-103572 Matters for Enterprise Developers

Millions of enterprise developers and database administrators rely on Microsoft integrated development environments every day. However, Microsoft’s official CVE-2026-103572 security advisory warns that attackers can exploit this flaw to run arbitrary commands. Because SQL Server Management Studio shares core code with Visual Studio, a single faulty library exposes both tools.

Specifically, the flaw resides in a shared dynamic link library named Microsoft.VisualStudio.Copilot.Core.dll. An attacker can trigger the Visual Studio Copilot RCE through indirect prompt injection when the AI assistant processes untrusted files or external data. Although public proof-of-concept demonstrations now exist online, Microsoft has confirmed no active exploitation in the wild so far.

How the Visual Studio Copilot RCE Attack Works

Windows Trailing-Dot Path Validation Bypass

In his technical analysis of the Visual Studio Copilot remote code execution flaw, Johann Rehberger explained the underlying file validation error. Normally, the application blocks the AI agent from modifying sensitive configuration files without user confirmation. In particular, the code checks whether a target file name matches protected names like .mcp.json or settings.visualstudio.json.

However, Windows file APIs ignore trailing periods at the end of file names during write operations. Consequently, an input string with a trailing dot passes the security check because the text strings do not match. Afterward, the Win32 layer strips the trailing dot and overwrites the actual protected configuration file.

Rehberger noted in his report that “a trailing dot allowed the AI agent to bypass protections around sensitive configuration files and modify settings it was explicitly supposed to be prevented from changing.” Additionally, he identified path traversal flaws in the trusted Extensions directory that expose local installation identifiers.

Indirect Prompt Injection and Configuration Hijacking

Once an attacker hijacks the AI assistant via untrusted content, the agent can alter local configuration settings. First, in both Visual Studio and SSMS, the compromised agent can register a malicious command as a Model Context Protocol (MCP) server. The IDE then launches that rogue MCP server automatically and executes the command.

Second, Visual Studio users face an additional attack vector through the internal search configuration. Specifically, the hijacked agent can point the ripgrepPath setting to an arbitrary executable binary. Whenever the AI assistant runs a text search, Visual Studio launches that binary on the host machine.

Affected Microsoft Products and Versions

According to the vendor advisory and researcher findings, CVE-2026-103572 impacts several major development releases:

• Microsoft Visual Studio 2026 with GitHub Copilot integration
• Microsoft Visual Studio 2022 and Visual Studio Tools for Applications
• Microsoft SQL Server Management Studio (SSMS) versions with Copilot and MCP support

Patch Details and Mitigation Steps

Rehberger reported the vulnerability to Microsoft on August 4, 2026. Subsequently, Microsoft shipped the official security patch on October 13, 2026, though the company marked the report out of scope for a bug bounty reward. To fix the flaw, Microsoft added a GetFullPath function call before the file name check. As a result, the application removes trailing dots and resolves relative path components before validating file access.

As Rehberger warned, “security controls around agents must hold even when the agent itself is compromised or misaligned.” Therefore, administrators and developers should apply the October 2026 security updates for Visual Studio and SSMS right away. Furthermore, teams should restrict AI agents from processing untrusted repositories or unverified MCP server responses until patching is complete.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.