---
title: "Visual Studio Copilot CVE-2026-103572: Trailing-Dot RCE"
url: https://erroneo.us/security/briefs/visual-studio-copilot-cve-2026-103572-rce/
description: "Prompt injection plus a trailing-dot path bypass let Copilot in Visual Studio and SSMS rewrite .mcp.json and run code. Fixed in 17.14.42/18.10.4. Patch."
type: security-brief
section: "Security Digest"
date_published: 2026-10-13
date_modified: 2026-10-16
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2026-103572"]
severity: "high"
exploited: "public-poc"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Visual Studio Copilot CVE-2026-103572: Trailing-Dot RCE

**Verdict: Patch this week.** If your developers use Copilot in Visual Studio or SSMS, update this week: exploitation needs only text the agent reads, and the researcher's write-up spells out the chain.

- **Who must act:** Teams on Visual Studio 2022 17.14 before 17.14.42, Visual Studio 2026 18.10 before 18.10.4, or SSMS with Copilot, especially where agents read untrusted repositories, files or MCP server output.
- **Who can relax:** VS Code users (not in Microsoft's affected list) and installs where Copilot is not used, though updating remains the clean fix.
- **Affected:** Visual Studio 2022 version 17.14.0 through 17.14.41; Visual Studio 2026 version 18.10.0 through 18.10.3; SQL Server Management Studio with Copilot (shares Microsoft.VisualStudio.Copilot.Core.dll; Microsoft names no SSMS build)
- **Fixed:** Visual Studio 2022 17.14.42; Visual Studio 2026 18.10.4; SSMS: no fixed build named by Microsoft as of Oct 21, 2026; latest is 22.11.1 (Oct 20)
- **CVEs:** CVE-2026-103572
- **CISA KEV:** no · **Exploitation:** Public proof-of-concept

## What to do

1. Update Visual Studio with the Visual Studio Installer to 17.14.42 or 18.10.4 or later, and confirm the version in Help > About.
2. Update SSMS to the latest 22.x release, since Microsoft's advisory does not name a fixed SSMS build.
3. Inventory fleet versions with vswhere -all -property catalog_productDisplayVersion.
4. Review .mcp.json and settings.VisualStudio.json in solutions and user profiles for MCP servers or a ripgrep path nobody added.
5. Until patched, keep Copilot agent mode away from untrusted repositories, files and MCP servers.

### How to check if you are affected

- Look for MCP server entries in .mcp.json (repository or %USERPROFILE%\.mcp.json) and enabledMcpServers that nobody on the team added.
- Check settings.VisualStudio.json for a ripgrep path pointing at anything other than the bundled rg.exe.
- Hunt for unexpected child processes of devenv.exe or Ssms.exe, such as shells or binaries launched as MCP servers.

## What happened

On October 13, 2026 (Patch Tuesday), Microsoft fixed [CVE-2026-103572](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103572), a code injection flaw (CWE-94) in the Copilot integration shared by Visual Studio and SQL Server Management Studio. Microsoft rates it Important, CVSS 3.1 8.8. Its FAQ explains the attack: an attacker "can deliver a malicious prompt remotely without prior access," and a user only has to interact with Copilot for the injected instructions to escalate into code execution.

Johann Rehberger, who reported it on August 4, published the [technical details](https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/) the same day. Copilot's agent should ask for confirmation before editing protected configuration files such as `.mcp.json` and `settings.VisualStudio.json`. The check, in `Microsoft.VisualStudio.Copilot.Core.dll`, compared file names as literal strings. Windows' Win32 layer drops a trailing period, so a write to `.mcp.json.` passed the check and still overwrote the real `.mcp.json`. Rehberger showed two ways to turn that into code execution:

- Add a malicious server to `.mcp.json`, enable it via `enabledMcpServers`, and let the IDE launch its command.
- In Visual Studio, point the ripgrep path setting in `settings.VisualStudio.json` at an arbitrary binary, which then runs whenever Copilot searches text.

The trigger is indirect prompt injection: instructions hidden in a file the developer opens, in repository content, or in output returned by an MCP server. Rehberger also reported a path traversal out of the trusted Extensions directory. His reading of the patch is that Microsoft added a `GetFullPath` call, which strips trailing dots and resolves `..` before the check.

## Who is affected

Microsoft's update table and the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-103572) list Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4. The advisory title also names SSMS, which shares the Copilot code, but Microsoft gives no fixed SSMS build. The [SSMS 22 release notes](https://learn.microsoft.com/en-us/ssms/release-notes-22) do not mention the CVE. SSMS 22.11.0, released October 13, moved to the Visual Studio 18.11.0 base, and 22.11.1 followed on October 20. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-103572) still shows the CVE as undergoing analysis.

## Do you really need to act?

Yes, on a normal fast cycle. Microsoft marks the CVE as not exploited and "Exploitation Less Likely", and CISA's enrichment says exploitation is "none." It is not in KEV. But the precondition is cheap: the attacker never touches the machine, only text that Copilot reads. With the write-up public ([SecurityOnline](https://securityonline.info/cve-2026-103572-visual-studio-copilot-rce-disclosed/) covers the proof of concept), reproducing it is straightforward. The impact is code execution as the developer, which usually means source code, cloud credentials and signing keys. Teams that open third-party repositories or wire in community MCP servers should treat this as urgent.

## What to do now

1. Update Visual Studio through the Visual Studio Installer to 17.14.42 or 18.10.4 or later. For fleets, inventory versions with `vswhere -all -property catalog_productDisplayVersion`.
2. Update SSMS to the latest 22.x release, and keep checking Microsoft's advisory for an SSMS-specific build.
3. Review `.mcp.json` files in solutions and in `%USERPROFILE%`, plus `settings.VisualStudio.json`, for servers or a ripgrep path nobody added.
4. Until you're patched, keep Copilot agent mode away from untrusted repositories, files and MCP servers.

## How to tell if you were hit

Look for MCP server entries or `enabledMcpServers` changes that nobody on the team made, and for a ripgrep path in `settings.VisualStudio.json` that points anywhere other than the bundled binary. In EDR telemetry, look for unexpected children of `devenv.exe` or `Ssms.exe`, such as shells, scripting hosts or unknown binaries started as MCP servers. If you find any, treat the developer's credentials and tokens as exposed and rotate them.

## Timeline

- Aug 4, 2026 — Rehberger reports the path bypass to MSRC.
- Sep 16, 2026 — Microsoft confirms the vulnerability.
- Oct 13, 2026 — Patch Tuesday fix ships (17.14.42, 18.10.4). Rehberger publishes his write-up. SSMS 22.11.0 is released.
- Oct 16, 2026 — MSRC adds download and KB links. The fixed builds are unchanged.

## Sources

1. [Microsoft MSRC — CVE-2026-103572: Visual Studio Tools for Applications and SQL Server Management Studio RCE](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103572)
2. [CVE record — CVE-2026-103572](https://www.cve.org/CVERecord?id=CVE-2026-103572)
3. [NVD — CVE-2026-103572](https://nvd.nist.gov/vuln/detail/CVE-2026-103572)
4. [Embrace The Red (Johann Rehberger) — Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)](https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/)
5. [Microsoft Learn — Release notes for SQL Server Management Studio 22](https://learn.microsoft.com/en-us/ssms/release-notes-22)
6. [SecurityOnline — CVE-2026-103572 Visual Studio Copilot RCE disclosed](https://securityonline.info/cve-2026-103572-visual-studio-copilot-rce-disclosed/)

---
Source page: https://erroneo.us/security/briefs/visual-studio-copilot-cve-2026-103572-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt