Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)

Summary

Microsoft patched a Remote Code Execution vulnerability in Visual Studio Copilot, reported by the researcher in August and classified as Important severity. The flaw sits in Microsoft.VisualStudio.Copilot.Core.dll and affects Copilot in Visual Studio and SQL Server Management Studio, which share code. A trailing dot in a filename passes the path validation check in EditsFunctionHandler.GetEditConfirmationTypeAsync, but Windows strips the dot on write, letting Copilot modify protected MCP and settings files and achieve arbitrary command execution.

Mitigation

Patch released by Microsoft for the Visual Studio Copilot and SSMS vulnerability.

Topics

• Coding assistants

Related items

• InfoXbox is officially embracing the chaos of AI-powered game portsSame vendor · The Verge (AI)
• MediumOver 1,500 npm packages exposed by Trusted Publishing validation flawSame vendor · CSO Online
• InfoSecure AI-Generated Code at the Source | Endor LabsSame vendor · Endor Labs Blog
• InfoMicrosoft’s new AI chip makes it less reliant on Nvidia’s GPUsSame vendor · The Verge (AI)
• MediumResearchers bypass 6 AI agent frameworks with a simple ‘Repeat-After-Me’ promptSame vendor · CSO Online