> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Privilege escalation in Visual Studio and PowerShell CVE-2026-111497
- URL: https://f4n6.co.uk/security-feed/privilege-escalation-in-visual-studio-and-powershell-cve-2026-111497/
- Published: 2026-10-26T18:36:13.000Z
- Updated: 2026-10-26T18:36:13.000Z
- Author: Jeff Davies
- Tags: #security-feed, CVE-2026-111497

## 1\. Executive summary

Microsoft has published a fix for CVE-2026-111497, a privilege-escalation flaw affecting Visual Studio 2019, 2022 and 2026 and PowerShell 7.4, 7.5 and 7.6, disclosed in the MSRC update guide on 25 October 2026 and relayed by CERT-FR the following day. NVD scores it 9.2 CRITICAL (CWE-252 unchecked return value, CWE-787 out-of-bounds write). It is not in CISA KEV, but EPSS sits at 36%, so exploitation in the wild is plausible within weeks and should be treated as likely rather than theoretical. The exposure for EMEA financial services is concentrated in developer and build infrastructure: CI runners, build agents and engineering workstations running unpatched Visual Studio or PowerShell 7.x, where a local attacker who lands on the host can use the flaw to escalate. No public exploitation, actor attribution or in-the-wild activity is reported in the sources.

## 2\. Regulatory framing

| Article            | Trigger (the fact in this item)                                                                                                                                            | Practical impact                                                                                                                            |
| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28       | The affected components (Visual Studio, PowerShell 7.x) sit in the ICT third-party estate sourced from Microsoft, and the fix is delivered through the MSRC update channel | Third-party risk register must record the dependency and the patched versions; confirm contractual patch SLAs with Microsoft cover this CVE |
| NIS2 Art. 21(2)(d) | The vulnerability is in the software supply chain (developer tooling and scripting runtime) used to build and operate services                                             | Supply chain security measures must include a documented patch cadence for build and developer tooling, not just production servers         |

No other article in the reference is engaged. No incident has occurred, so DORA Art. 17, 18 and 19 and NIS2 Art. 23 reporting duties are not triggered by disclosure alone.

## 3\. Technical analysis & attack chain

CERT-FR classifies the impact as elevation of privileges. NVD records CVSS 9.2 CRITICAL with CWE-252 (unchecked return value) and CWE-787 (out-of-bounds write); the two weaknesses are consistent with a memory-safety bug where a return value is not checked before a write, but the sources do not describe the exact code path. No proof-of-concept, exploit code or in-the-wild sample is referenced.

Affected versions, per CERT-FR:

- Visual Studio 2019 16.11 before 16.11.61
- Visual Studio 2022 17.14 before 17.14.43
- Visual Studio 2026 18.11 before 18.11.2
- Visual Studio 2026 18.12 before 18.12 Insiders 3
- PowerShell 7.4 before 7.4.22
- PowerShell 7.5 before 7.5.13
- PowerShell 7.6 before 7.6.9

A separate CERT-FR advisory (CERTFR-2026-AVI-1382) on .NET also lists CVE-2026-111497 among its references, alongside CVE-2026-114148\. That advisory covers .NET 8.0, 9.0, 10.0 and 11.0 across Linux, macOS and Windows, plus source-build and ASP.NET Core runtime tarballs. The overlap means the same CVE identifier is cited against both the Visual Studio/PowerShell advisory and the .NET advisory; treat the .NET runtime as a possible additional affected surface and confirm against the MSRC entry before scoping patch work.

Confirmed attack chain, limited to what the sources support:

1. An attacker gains a foothold on a host running an affected Visual Studio or PowerShell 7.x build. The sources do not describe the initial-access vector, so this step is not characterised.
2. The attacker triggers the flaw to elevate privileges. CERT-FR states the impact as elevation of privileges; the mechanism (unchecked return value leading to an out-of-bounds write) is from NVD's CWE classification, not from a technical write-up.
3. Post-exploitation behaviour (persistence, credential access, lateral movement, exfiltration) is not described in any source and is not asserted here.

The practical risk is highest on shared build agents and CI runners, where a low-privileged process or a compromised dependency could use the flaw to reach the privileges of the build service account. That is an inference from the affected components, not a reported observation.

No MITRE ATT&CK technique mapping is available for this CVE, and no actor is named in any source. Attribution is unconfirmed and no campaign context exists.

## 4\. Mitigation & containment

P1 (within 24 hours)

- Inventory every host and container image running Visual Studio 2019/2022/2026 or PowerShell 7.4/7.5/7.6\. On Windows, check `$PSVersionTable.PSVersion` for PowerShell and the Visual Studio Installer version for VS. On Linux and macOS, run `pwsh -v`.
- Patch to the fixed versions: Visual Studio 2019 16.11.61, 2022 17.14.43, 2026 18.11.2 or 18.12 Insiders 3; PowerShell 7.4.22, 7.5.13, 7.6.9\. Fixes are in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497.
- On shared CI runners and build agents, restrict interactive logon and job execution to trusted pipelines until the patch is applied. A privilege-escalation flaw on a multi-tenant runner is the highest-value target in this estate.

P2 (within 72 hours)

- Confirm whether .NET 8.0/9.0/10.0/11.0 installations are in scope, given the cross-reference in CERTFR-2026-AVI-1382\. Patch .NET to 8.0.427, 9.0.320, 10.0.403 or 11.0.100-rc.3 as applicable if MSRC confirms the CVE affects the runtime.
- Pin PowerShell versions in container base images and build scripts to the fixed releases; rebuild and republish any image still on an affected tag.
- Review EDR coverage on developer endpoints and build hosts for anomalous child processes spawned from `devenv.exe` or `pwsh.exe` running at higher integrity than the parent.

P3 (within 7 days)

- Add the fixed versions to the standard software baseline and to the third-party component register (DORA Art. 28).
- Where Visual Studio or PowerShell cannot be patched immediately, remove the host from shared build pools and restrict it to single-tenant use until remediation completes.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The sources provide version ranges and CVE identifiers only; no hashes, filenames, network indicators or behavioural telemetry are published.

## 6\. Detection

Insufficient indicators to author detection rules. The sources contain no distinctive strings, command-line flags, file paths, registry keys or behavioural artefacts specific to exploitation of CVE-2026-111497\. Version-based asset queries (see §4) are the only reliable detection available until MSRC or a vendor publishes technical detail.

## CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

| CVE                                                                                | CVSS         | Exploited | EPSS | Summary                                                                                                                          |
| ---------------------------------------------------------------------------------- | ------------ | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- |
| [CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497?ref=f4n6.co.uk) | 9.2 Critical | —         | 36%  | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all pla… |

## 7\. Sources

- ANSSI France CERT-FR, "Vulnérabilité dans les produits Microsoft" (CERTFR-2026-AVI-1383), 26 October 2026\. https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1383/
- ANSSI France CERT-FR, "Multiples vulnérabilités dans Microsoft .Net" (CERTFR-2026-AVI-1382), 26 October 2026\. https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1382/
- Microsoft MSRC, "CVE-2026-111497", 25 October 2026\. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497
- CVE Program, "CVE-2026-111497". https://www.cve.org/CVERecord?id=CVE-2026-111497

## 8\. Adverse Trace position

Adverse Trace assesses CVE-2026-111497 as CVSS 9.2 CRITICAL, not in CISA KEV, with EPSS at 36%. The severity is high but the exploitation state is not confirmed: no public exploit, no actor and no in-the-wild activity is reported in any source, and the .NET cross-reference in CERTFR-2026-AVI-1382 is single-sourced to CERT-FR and should be verified against MSRC before scoping .NET patch work. Client impact is concentrated in developer and CI infrastructure rather than customer-facing systems, but a privilege-escalation flaw on a shared build runner is a credible stepping stone and warrants P1 treatment. Adverse Trace will monitor MSRC and CERT-FR for technical detail, exploit publication and any KEV addition, and will issue an update if exploitation is confirmed or the affected product scope changes.

---

[Read the original source →](https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1383/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*