Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)

What it is

CVE-2026-103572 is a file path validation bypass in Microsoft.VisualStudio.Copilot.Core.dll, the Copilot library shared by Visual Studio and SQL Server Management Studio (SSMS). Microsoft rated it Important, Remote Code Execution, CVSS 8.8. Visual Studio 2026 and older versions, including Visual Studio 2022, are affected. Johann Rehberger of Embrace The Red reported it on 4 August 2026, and the fix shipped on Patch Tuesday, 13 October 2026.

How it works

EditsFunctionHandler.GetEditConfirmationTypeAsync is meant to stop Copilot from writing to MCP and settings files. It compares the requested filename to a protected name. Windows ignores a trailing dot in a filename at the Win32 layer, so .mcp.json. differs from .mcp.json in the check but writes to .mcp.json.

The post lists these additional flaws:

• ~/.mcp.json. and settings.VisualStudio.json. both bypass the check. The second also fails when Solutions are used.
• Paths that start inside the trusted Extensions directory can contain ..\ and resolve outside it. That lets Copilot read SSMS.isolation.ini and the user settings file without confirmation.
• SSMS.isolation.ini discloses the InstallationID. That ID completes the path C:\Users\<user>\AppData\Local\Microsoft\SSMS\22.0_<InstallationID>\settings.json, which makes the exploit work across installations.

Two attack chains follow from this. In both VS and SSMS, a hijacked agent adds a malicious MCP server to .mcp.json, adds its name to enabledMcpServers, removes it from disabledMcpServers, and the IDE launches the command. In VS only, the agent overwrites copilot.general.tools.ripgrepPath in settings.VisualStudio.json. with an arbitrary binary, which runs on the next Copilot search. The proof of concept pointed it at calc.exe.

flowchart LR
    A[Prompt injection] --> B[Hijacked Copilot]
    B --> C{Write target}
    C -->|.mcp.json.| D[Malicious MCP server]
    C -->|settings.VisualStudio.json.| E[ripgrepPath override, VS only]
    D --> F[IDE launches command]
    E --> F

Preconditions / Affected

• Visual Studio 2026, older Visual Studio including 2022, and SSMS (the demos used SSMS 22.0 paths).
• The agent must be hijacked or misaligned. The author demonstrated this through indirect prompt injection against the MAI-Code-1-Flash model, which he says resists injection poorly. He notes the payload could also arrive through data returned by an MCP server.
• The user must interact with the poisoned content.

What to do

Install the 13 October 2026 Patch Tuesday update for Visual Studio and SSMS. The author reports the fix adds a GetFullPath call, which strips trailing dots and resolves .. components before the check.

Caveats

• The author inspected the fix only briefly. He says it addresses the trailing-dot bypass and "should also" prevent some path traversal variants, so full coverage is unconfirmed.
• Microsoft paid a $0 bounty, calling the issue out of scope. This is the author's third unrewarded patched report in two months.
• The post does not say whether the traversal and InstallationID leaks received separate CVEs.