CVE-2026-33115
A remote code execution vulnerability exists in .NET and Visual Studio due to unsafe deserialization in the BinaryFormatter fallback path. An attacker who successfully exploits this vulnerability could execute arbitrary code on the target system. The vulnerability was disclosed as part of the Microsoft April 2026 Patch Tuesday release, which remediated 167 vulnerabilities across Windows, Office, SharePoint, .NET, Defender, Active Directory, Remote Desktop, Azure, Hyper-V, and supporting components. This CVE was rated Critical severity with a CVSS 8.1 base score. Exploitation requires an attacker to craft a malicious serialized object that triggers the BinaryFormatter deserialization path, which can lead to full code execution in the context of the application.
CVSS v3 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
CWE-502
Threats tracking this CVE
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33115
- https://nvd.nist.gov/vuln/detail/CVE-2026-33115